Siemens

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Siemens product.

RSS Feeds for Siemens security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Siemens products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Siemens Sorted by Most Security Vulnerabilities since 2018

Siemens Teamcenter Visualization179 vulnerabilities

Siemens Jt2go140 vulnerabilities

Siemens Solid Edge105 vulnerabilities

Siemens Tecnomatix Plant Simulation95 vulnerabilities

Siemens Simcenter Femap85 vulnerabilities

Siemens Telecontrol Server Basic79 vulnerabilities

Siemens Sinema Remote Connect Server72 vulnerabilities

Siemens Sinec Nms59 vulnerabilities

Siemens Parasolid50 vulnerabilities

Siemens Simatic Wincc43 vulnerabilities

Siemens Sinec Ins41 vulnerabilities

Siemens Solid Edge Se202336 vulnerabilities

Siemens Ruggedcom Crossbow35 vulnerabilities

Siemens Comos33 vulnerabilities

Siemens Simatic Cn 410033 vulnerabilities

Siemens Simatic S7 1500 Software Controller32 vulnerabilities

Siemens Simatic Pcs Neo32 vulnerabilities

Siemens Simatic Pcs 727 vulnerabilities

Siemens Simatic S7 Plcsim Advanced23 vulnerabilities

Siemens Nucleus Readystart V322 vulnerabilities

Siemens Tecnomatix20 vulnerabilities

Siemens Simatic Rtls Locating Manager19 vulnerabilities

Siemens Simatic Step 719 vulnerabilities

Siemens Solid Edge Se202419 vulnerabilities

Siemens Sinec Traffic Analyzer15 vulnerabilities

Siemens Simatic Wincc Runtime Advanced14 vulnerabilities

Siemens Totally Integrated Automation Portal13 vulnerabilities

Siemens Spectrum Power 413 vulnerabilities

Siemens Scalance Lpe9403 Firmware12 vulnerabilities

Siemens Sinema Server12 vulnerabilities

Siemens Opcenter Quality11 vulnerabilities

Siemens Sipass Integrated10 vulnerabilities

Siemens Sinema Remote Connect Client9 vulnerabilities

Siemens Simatic Wincc Runtime Professional9 vulnerabilities

Siemens Sinec Security Monitor8 vulnerabilities

Siemens Sinumerik 840d Sl8 vulnerabilities

Siemens Logo Soft Comfort8 vulnerabilities

Siemens Simatic Net Pc8 vulnerabilities

Siemens Teamcenter8 vulnerabilities

Siemens Spectrum Power 77 vulnerabilities

Siemens Sinvrsivms Video Server7 vulnerabilities

Siemens Simatic Winac Rtx F 20107 vulnerabilities

Siemens Opcenter Execution Foundation7 vulnerabilities

Siemens Opcenter Intelligence6 vulnerabilities

Siemens Tia Administrator6 vulnerabilities

Siemens Polarion Alm5 vulnerabilities

Siemens Simatic Route Control5 vulnerabilities

Siemens Solid Edge Se20225 vulnerabilities

Siemens Simatic Batch5 vulnerabilities

Siemens Questa4 vulnerabilities

Siemens Desigo Cc4 vulnerabilities

Siemens Openpcs 74 vulnerabilities

Siemens Location Intelligence4 vulnerabilities

Siemens Modelsim4 vulnerabilities

Siemens Omnivise T3000 Application Server4 vulnerabilities

Siemens Simatic Easie Core Package4 vulnerabilities

Siemens Cerberus Pro Ul X300 Cloud3 vulnerabilities

Siemens Desigo Fire Safety Ul Compact Panel3 vulnerabilities

Siemens Desigo Fire Safety Ul Engineering Tool3 vulnerabilities

Siemens Logo3 vulnerabilities

Known Exploited Siemens Vulnerabilities

The following Siemens vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.

Title	Description	Added
Siemens SIMATIC CP 1543-1 Improper Privilege Management Vulnerability	An improper privilege management vulnerability exists within the Siemens SIMATIC Communication Processor (CP) that allows a privileged attacker to remotely cause a denial of service. CVE-2016-8562 Exploit Probability: 3.6%	March 3, 2022

By the Year

In 2026 there have been 164 vulnerabilities in Siemens with an average score of 7.2 out of ten. Last year, in 2025 Siemens had 221 security vulnerabilities published. Right now, Siemens is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 0.15

Year	Vulnerabilities	Average Score
2026	164	7.16
2025	221	7.31
2024	251	7.13
2023	306	7.36
2022	413	7.19
2021	376	7.16
2020	121	6.68
2019	193	7.38
2018	39	7.70

It may take a day or so for new Siemens vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Siemens Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-89208	Oct 13, 2026	Siemens Desigo/Capital AR Classic Input Bounds OOB Read (CVE-2026-89208) A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3). The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries.
CVE-2026-89206	Oct 13, 2026	RuggedCom CROSSBOW < V6.0: Auth Bypass for Scheduled Tasks A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to modify the state of scheduled actions. This could allow an authenticated attacker with minimal privileges to retry, stop, or delete scheduled tasks without proper authorization.	Ruggedcom Crossbow
CVE-2026-89205	Oct 13, 2026	RUGGEDCOM CROSSBOW <V6.0 Server-Side Auth Bypass for Special Ops Scheduling A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to schedule special operations. This could allow an authenticated attacker with minimal privileges to schedule unauthorized operations on devices.	Ruggedcom Crossbow
CVE-2026-89204	Oct 13, 2026	CVE202689204: RUGGEDCOM CROSSBOW <V6.0 DB Access Bypass A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet management. This could allow an authenticated attacker to read, modify, or delete subnet configurations, leading to unauthorized information disclosure and data manipulation.	Ruggedcom Crossbow
CVE-2026-89203	Oct 13, 2026	RUGGEDCOM CROSSBOW <V6.0: Authenticated DB Query Info Disclosure A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing users to retrieve system-wide information that is not intended for their privilege level. This could allow an authenticated attacker to gather sensitive information about the system's infrastructure, including details on all devices, substations, users, and scheduled activities.	Ruggedcom Crossbow
CVE-2026-89202	Oct 13, 2026	CVE-2026-89202: RUGGEDCOM CROSSBOW < V6.0 AuthZ Bypass Disallow Session Disconnect A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection requests. This could allow an authenticated attacker with minimal privileges to disconnect active sessions of other users, including administrators, leading to a denial of service.	Ruggedcom Crossbow
CVE-2026-89201	Oct 13, 2026	RUGGEDCOM CROSSBOW SQL Injection via Device Group Names (v <6.0) A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility names processed during the Bulk Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.	Ruggedcom Crossbow
CVE-2026-89200	Oct 13, 2026	RUGGEDCOM CROSSBOW <6.0 SQLi in custom file label (Name/Value fields) A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields for custom file labels. This could allow an authenticated attacker with administrative privileges to execute arbitrary SQL commands on the underlying database.	Ruggedcom Crossbow
CVE-2026-89199	Oct 13, 2026	RUGGEDCOM CROSSBOW (<V6.0): Authenticated DB Query Info Disclose A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal systems, leading to unauthorized information disclosure and privilege escalation.	Ruggedcom Crossbow
CVE-2026-89198	Oct 13, 2026	RUGGEDCOM CROSSBOW < V6.0 SQLI via Unsanitized Firmware Filename A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename of firmware files uploaded to the system. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.	Ruggedcom Crossbow
CVE-2026-89197	Oct 13, 2026	SQLi in RuggedCom Crossbow <V6.0 via Notification Value Field A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Value field of notification conditions processed during the Notification Profile configuration. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.	Ruggedcom Crossbow
CVE-2026-89196	Oct 13, 2026	SQL Injection in Ruggedcom Crossbow v<6.0 Bulk Import Facility Names A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in facility names processed during the Bulk Import/Export workflow. This could allow an authenticated attacker with specific privileges to execute arbitrary SQL commands on the underlying database.	Ruggedcom Crossbow
CVE-2026-85115	Oct 13, 2026	Info Disclosure in Siemens .NET Client Lib for SIMATIC S7 <3.3.62 A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not properly redact PLC restore passwords from HTTP error exception messages. This could allow an attacker with access to logs or other diagnostic output to obtain the plaintext restore password and potentially perform unauthorized operations on the PLC.
CVE-2026-85114	Oct 13, 2026	.NET Client Library S7 API <3.3.61 Remote File Write CVE-2026-85114 A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not properly validate filenames received from remote servers during ticket downloads. This could allow an attacker who can manipulate the ticket response to write arbitrary files outside the intended download directory and, when overwriting is enabled, replace existing files accessible to the application.
CVE-2026-78557	Oct 13, 2026	Industrial Edge App Publisher <1.27.9: RCE via unsanitized XSS in Node.js A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine
CVE-2026-78556	Oct 13, 2026	Siemens Industrial Edge App Publ <V1.27.9: TLS Cert Validation Bypass A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the server certificate when initiating a TLS connection. This allows an attacker to intercept and relay communication (Man-in-the-Middle attack) and to spoof a trusted entity by interfering in the communication path between the client and the intended server.
CVE-2026-72895	Oct 13, 2026	SIMATIC IPC Secure Boot Bypass via Test Key (V<31.01.13) A vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G (All versions < V28.01.15). A BIOS vendor test key is present in the UEFI Secure Boot key database. This could allow a local attacker with physical or administrative access to the device to boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.
CVE-2026-63357	Oct 13, 2026	Siemens PLC XSS via malicious calculated signal file on Trace page Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right Read diagnostics into importing a specially crafted file. Successful exploitation could allow attacker-controlled JavaScript to execute in the users browser session and perform PLC operations through the web server within the scope of the users authorization.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-63356	Oct 13, 2026	Siemens XSS: Untrusted CSV Trace Names in Error Messages Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right Read diagnostics into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the users browser session when the resulting error message is displayed.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-63355	Oct 13, 2026	Siemens TIA Portal XSS via Unsanitized CSV Trace Signal Names Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right Read diagnostics into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the users browser session when the user subsequently interacts with an affected selection menu.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-63354	Oct 13, 2026	Siemens Web UI CSV Trace XSS via unsanitized Visual Marker Data Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right Read diagnostics into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the users browser session and perform PLC operations through the web server within the scope of the users authorization.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-63353	Oct 13, 2026	Siemens PLC XSS via Unsanitized Trace File Import Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right Read diagnostics into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the users browser session and perform PLC operations through the web server within the scope of the users authorization.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-63352	Oct 13, 2026	Siemens PLC Web UI XSS via unsanitized CSV trace import Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right Read diagnostics into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the users browser session and perform PLC operations through the web server within the scope of the users authorization.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-63351	Oct 13, 2026	Siemens PLC Web Interface XSS via CSV Trace Import Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right Read diagnostics into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the users browser session and perform PLC operations through the web server within the scope of the users authorization.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-63350	Oct 13, 2026	Siemens PLC Trace Import XSS Allows Browser JS Execution & PLC Ops Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right Read diagnostics into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the users browser session and perform PLC operations through the web server within the scope of the users authorization.	Simatic S7 1500 Software Controller Simatic S7 Plcsim Advanced
CVE-2026-59241	Oct 13, 2026	SIMATIC WinCC DB Role PrivEsc (V7.5, V8.0 < U11, V8.1 < U7) A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All versions < V8.1 Update 7). The affected application does not sufficiently restrict the permissions assigned to a database role. This could allow an authenticated remote attacker with database access to escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to a compromise of the system.	Simatic Wincc
CVE-2026-44415	Oct 13, 2026	Siemens Authenticated Remote API Info Disclosure via Unrestricted Paths Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.
CVE-2026-44414	Oct 13, 2026	Siemens Industrial Edge Device Kit 1.28 No Auth for Internal APIs A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial Edge Device Kit - arm64 V1.15, Industrial Edge Device Kit - arm64 V1.16, Industrial Edge Device Kit - arm64 V1.17, Industrial Edge Device Kit - arm64 V1.18, Industrial Edge Device Kit - arm64 V1.19, Industrial Edge Device Kit - arm64 V1.20, Industrial Edge Device Kit - arm64 V1.21, Industrial Edge Device Kit - arm64 V1.22, Industrial Edge Device Kit - arm64 V1.23, Industrial Edge Device Kit - arm64 V1.24, Industrial Edge Device Kit - arm64 V1.25, Industrial Edge Device Kit - arm64 V1.26, Industrial Edge Device Kit - arm64 V1.27, Industrial Edge Device Kit - arm64 V1.28, Industrial Edge Device Kit - arm64 V1.5, Industrial Edge Device Kit - arm64 V1.6, Industrial Edge Device Kit - arm64 V1.7, Industrial Edge Device Kit - arm64 V1.8, Industrial Edge Device Kit - arm64 V1.9, Industrial Edge Device Kit - x86-64 V1.10, Industrial Edge Device Kit - x86-64 V1.11, Industrial Edge Device Kit - x86-64 V1.12, Industrial Edge Device Kit - x86-64 V1.13, Industrial Edge Device Kit - x86-64 V1.14, Industrial Edge Device Kit - x86-64 V1.15, Industrial Edge Device Kit - x86-64 V1.16, Industrial Edge Device Kit - x86-64 V1.17, Industrial Edge Device Kit - x86-64 V1.18, Industrial Edge Device Kit - x86-64 V1.19, Industrial Edge Device Kit - x86-64 V1.20, Industrial Edge Device Kit - x86-64 V1.21, Industrial Edge Device Kit - x86-64 V1.22, Industrial Edge Device Kit - x86-64 V1.23, Industrial Edge Device Kit - x86-64 V1.24, Industrial Edge Device Kit - x86-64 V1.25, Industrial Edge Device Kit - x86-64 V1.26, Industrial Edge Device Kit - x86-64 V1.27, Industrial Edge Device Kit - x86-64 V1.28, Industrial Edge Device Kit - x86-64 V1.5, Industrial Edge Device Kit - x86-64 V1.6, Industrial Edge Device Kit - x86-64 V1.7, Industrial Edge Device Kit - x86-64 V1.8, Industrial Edge Device Kit - x86-64 V1.9, Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413 (6GK5998-3GS01-2AC2), SCALANCE LPE9433 (6GK5998-3GS11-2AC2), SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2), SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2), SIMATIC IPC BX-21A Industrial Edge Device, SIMATIC IPC BX-39A Industrial Edge Device, SIMATIC IPC BX-59A Industrial Edge Device, SIMATIC IPC127E Industrial Edge Device, SIMATIC IPC227E Industrial Edge Device, SIMATIC IPC227G Industrial Edge Device, SIMATIC IPC427E Industrial Edge Device, SIMATIC IPC847E Industrial Edge Device. Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system.
CVE-2026-89207	Sep 16, 2026	CVE-2026-89207: Unauth Remote Input Validation Flaw in Siemens WTV Web Interface (Pre3.94/4.17) A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access).
CVE-2026-67367	Sep 08, 2026	Dir Traversal in SIMOVE Fleetmanager/SIPLANT HTTP Server (V < 3.1.13) A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4), SIMOVE Fleetmanager V3.3 (All versions < V3.3.2), SIMOVE Fleetmanager V4.0 (All versions < V4.0.1), SIPLANT V1.7 (All versions), SIPLANT V2.2 (All versions), SIPLANT V3.0 (All versions), SIPLANT V3.1 (All versions < V3.1.4). Affected devices do not properly validate and neutralize directory traversal sequences in the file-serving endpoint of the embedded HTTP server. This could allow an unauthenticated remote attacker to read arbitrary files from the underlying operating system without any credentials, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets.
CVE-2026-62654	Sep 08, 2026	Reyrolle 7SR5 maintenance mode exec flaw (v<2.70) A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A special maintenance mode can be activated via a physical key sequence during device boot, in which the device downloads and executes program code from a network server without verifying its authenticity or integrity. This could allow an attacker with physical access to the device to upload and execute arbitrary, unsigned code.
CVE-2026-62653	Sep 08, 2026	Reyrolle 7SR5 <V2.70 mem corruption via firmwareupdate mode A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device.
CVE-2026-62652	Sep 08, 2026	Reyrolle 7SR5 Firmware Debug Symbols Leak (All < V2.70) A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The device firmware contains binaries from which debugging symbols have not been removed. This could allow an unauthenticated attacker with access to the publicly available firmware update files to more easily reverse engineer the device's firmware, facilitating the identification of further vulnerabilities.
CVE-2026-62650	Sep 08, 2026	Reyrolle 7SR5 <V2.70 RBAC Bypass in Web UI A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Server-side authorization checks in the web-based management interface are not properly enforced, allowing role-based access control (RBAC) restrictions to be bypassed through manipulation of request data. This could allow an authenticated, low-privileged remote attacker to escalate privileges to an administrative level.
CVE-2026-62649	Sep 08, 2026	Reyrolle 7SR5 Web Server DoS via Unbounded HTTP Requests (All < V2.70) A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resources when processing a high volume of concurrent HTTP requests. This could allow an unauthenticated remote attacker to cause the entire device to crash and reboot, resulting in a denial-of-service condition.
CVE-2026-62648	Sep 08, 2026	Reyrolle 7SR5 V<2.70 - OOB Write in URL Pre-Auth HTTP Msg (Siemens) A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The length of the URL component contained in pre-authenticated HTTP messages is not properly validated before appending additional data to it, resulting in an out-of-bounds write condition in memory. This could allow an unauthenticated remote attacker to crash the affected device, causing a reboot and resulting in a denial-of-service condition.
CVE-2026-62647	Sep 08, 2026	Reyrolle 7SR5 <v2.70: Predictable RNG Allows Auth Bypass A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device.
CVE-2026-62646	Sep 08, 2026	Low-entropy Session ID in Reyrolle 7SR5 (V2.70) A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufficient randomness, resulting in a token with low entropy that can be predicted or brute-forced within a feasible number of attempts. This could allow an unauthenticated remote attacker to derive valid session identifiers and bypass authentication.
CVE-2026-62645	Sep 08, 2026	Reyrolle 7SR5 Auth Bypass via Web Interface (pre-V2.70) A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device.
CVE-2026-58113	Sep 08, 2026	Siemens Teamcenter XSS via auth redirect ( V2606.2607) A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session.
CVE-2026-50093	Sep 08, 2026	Root Upload Vulnerability in Siemens Siveillance Control <v4.0.11.2177 OIS Module A vulnerability has been identified in Siveillance Control Pro V3.0 (All versions < V3.0.12.2173), Siveillance Control Pro V4.0 (All versions < V4.0.9.2178), Siveillance Control V3.0 (All versions < V3.0.22.2177), Siveillance Control V4.0 (All versions < V4.0.11.2177). A vulnerability in the OIS web module allows an attacker to upload arbitrary files to the server. Successful exploitation of this vulnerability could allow an attacker to gain root access on the host system, potentially leading to a full compromise of the affected OIS environment.
CVE-2026-34223	Sep 08, 2026	Desigo CC Client CCE via Malicious Graphics Script A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded within user-defined graphics documents. Specifically, when the script within a graphics document is designed or modified by an attacker to include malicious commands. When a user opens a compromised graphics document, the embedded script is executed on the client application instance, allowing an attacker to write arbitrary files to the client's operating system. Successful exploitation requires an attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. This could lead to compromise of the client operating system and potential lateral movement within the organization.
CVE-2026-80465	Sep 03, 2026	Mendix SAML <v4.2.3 Signature Validation Flaw A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.3), Mendix SAML (Mendix 9.24 compatible) (All versions < V3.6.27). Affected versions of the module do not properly validate the SAML response signature. This could allow unauthenticated remote attackers to hijack an account (session) in specific SSO configurations.
CVE-2026-66155	Aug 27, 2026	Element maps-ng <v47.12.3 XSS via si-map tooltip points A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.
CVE-2026-54548	Aug 26, 2026	Kas <5.4: SSH No HostKeyCheck Persists Causing MITM risk kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity. This issue is fixed in version 5.4.
CVE-2026-47192	Aug 14, 2026	kas 4.8-5.3 repo config signature validation order flaw kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker must have gained control of a repository that a kas file of the victim is referencing. Furthermore, the following conditions must be fulfilled: the victim's kas configuration must include a configuration file from the attacked repository; the repository state is referenced by tag, and no commit ID is specified (this is triggering a warning, though); the key used for validating the tag or commit signature is stored as file in a repository; no fingerprint for the key is specified; and the `_source_dir` key must not be set by the victim when calling kas (e.g. by avoiding a local `.config.yaml`). Given these conditions, the attacker could modify the included kas configuration in way that the key used to validate the tag signature of the attacker's repository could be replaced by an attacker-chosen key. No other exploit possibilities have been identified so far, but this does not rule out that those may exist. All patches have been released along with kas version 5.3. As a workaround, pin the expected signature key via its fingerprint, also when storing it as file in a repository.
CVE-2026-47191	Aug 14, 2026	kas <5.3: Commit ID Validation Bypass via Branch Collision kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs. Version 5.3 fixes the issue. As a workaround, avoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one.
CVE-2026-69109	Aug 11, 2026	Siemens SLS <5.3 Path Traversal: Arbitrary File Access A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application.
CVE-2026-69108	Aug 11, 2026	Siemens License Server <5.1 Local Privilege Escalation via insecure sudoers A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. This could allow an attacker to execute arbitrary commands and plant malicious files as root, leading to full system compromise.
CVE-2026-64629	Aug 11, 2026	OOB Read in Parasolid V38.0/V38.1 (<38.0.235/<38.1.230) X_T Parser A vulnerability has been identified in Parasolid V38.0 (All versions < V38.0.235), Parasolid V38.1 (All versions < V38.1.230). The affected applications contains an out of bounds read vulnerability while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process.	Parasolid