199 results · Clear filters · Feed
-
Critical max 9.2
MB connect line: php2shell in mbCONNECT24/mymbCONNECT24
MB connect line mbCONNECT24/mymbCONNECT24 ships with a bundled PHP version that is affected by two vulnerabilities known as "php2shell".
-
Critical max 8.7VDE-2026-079 12 CVEs
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow RCE, DoS or information leakage.
-
Critical max 9.2
Helmholz: php2shell in myREX24V2/myREX24V2.virtual
Helmholz myREX24V2/myREX24V2.virtual ships with a bundled PHP version that is affected by two vulnerabilities known as "php2shell".
-
Critical max 8.7VDE-2026-141 12 CVEs
Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual
Multiple vulnerabilities have been discovered in Helmholz myREX24V2/myREX24V2.virtual that could allow RCE, DoS or information leakage.
-
Critical max 9.8
Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG)
Bender is publishing this advisory to inform customers about two vulnerabilities in the Linux kernel used by the EDGE500IP. CISA has added both vulnerabilities (CVE-2025-39682 and CVE-2025-39964) to its Known Exploited Vulnerabilities catalog. Bender has anal…
-
Critical max 9.2
Two critical PHP vulnerabilities in several Festo Didactic products
Festo Didactic FactoryViews and MES4 deployed along with xampp bundle an Apache web server with PHP. The bundled version of PHP is vulnerable to the two critical vulnerabilities CVE-2026-109618 and CVE-2026-109619 (commonly referred to as PHP2Shell). These vu…
first Nov 2, 2026 -
Critical max 9.1VDE-2026-102 1 CVE
WAGO: Unauthorized Account Access via Credential Recovery Process
A vulnerability in the authentication and credential recovery process may allow an unauthenticated attacker to bypass intended verification controls during password reset operations. By exploiting this weakness, an attacker could reset credentials for arbitra…
-
Critical max 9.2
WAGO: Multiple Devices affected by PHP2Shell
Critical vulnerabilities in the PHP runtime may allow a remote attacker to execute arbitrary code by exploiting weaknesses in PHP's internal memory and request handling mechanisms. Under specific conditions, specially crafted web requests can trigger unexpect…
first Nov 2, 2026 -
Critical max 9.2
Welotec: PHP2Shell Vulnerabilities in SMART EMS
Two memory-safety vulnerabilities in the PHP runtime bundled with SMART EMS allow an unauthenticated remote attacker to execute arbitrary code in the context of the PHP web worker. All SMART EMS versions up to and including v3.5.3 are affected. Exploitability…
-
Critical max 9.2
METTLER TOLEDO: PHP2Shell in Octo Image Server
OCTO Image Server contains a vulnerable version of PHP affected by PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We strongly recommend to upgrade PHP to version 8.2.35.
-
Critical max 8.8FSA-202602 2 CVEs
Multiple OpenSSL vulnerabilities affect Festo AX OS in CEPE
Festo AX OS versions 25.0.1.46 and 25.9.2.4, which are based on PLCnext by Phoenix Contact, used by the Festo product CEPE are affected by multiple OpenSSL vulnerabilities. The vulnerabilities are identified as CVE-2025-15467 and CVE-2025-69419. Attacks may b…
-
Critical max 9.8VDE-2026-112 1 CVE
METTLER TOLEDO: STARe Software DB2 vulnerable component
A vulnerability identified as CVE-2026-10109 affects the external component IBM Db2 12.1.2 delivered with STARe v20.00. The vulnerability is associated with improper handling of the pre-authentication DRDA handshake in affected IBM Db2 versions
-
Critical max 9.8VDE-2026-108 1 CVE
Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data
The aas-edge-client is a reference implementation of an Asset Administration Shell (AAS) edge application, published by Murrelektronik GmbH on GitHub for the LNI 4.0 testbed demonstrator. Its REST API is bound to all network interfaces on TCP port 18000, requ…
-
Critical max 9.8VDE-2025-102 1 CVE
WAGO: Multiple Devices are affected by a Vulnerability in BACnet IP Stack
Multiple WAGO devices are affected by a vulnerability in the dynamic creation of BACnet File Objects. The object name is used as a file path without sufficient validation and is not restricted to the intended directory, so relative paths can be used to reach …
-
Critical max 9.6VDE-2026-089 1 CVE
Lenze: VPN Client Remote Code Execution in combination with Lenze x500 IoT Gateway
The Lenze VPN client is vulnerable to a Remote Code Execution. The vulnerability would allow an attacker to perform a remote code execution on the computer running the client with elevated privileges.
-
Critical max 9.8
iba: Deserialization vulnerability in ibaPDA and ibaDatCoordinator
A vulnerability has been identified in ibaPDA, ibaDatCoordinator and ibaLogic. The affected applications do not properly restrict the .NET BinaryFormatter when deserializing client-server input. This could allow an attacker to cause a type confusion and execu…
first Jun 17, 2026 -
Critical max 9.8VDE-2026-027 20 CVEs
Phoenix Contact: Multiple vulnerabilities in the firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices
The firmware of IOL MA8 EIP DI8 and IOL MA8 PN DI8 devices is affected by security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified s…
-
Critical max 9.8VDE-2026-014 20 CVEs
Pepperl+Fuchs: ICE2-* and ICE3-* are affected by multiple security vulnerabilities
The affected devices have security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified schemata can be used to read sensitive informatio…
-
Critical max 9.8VDE-2026-028 20 CVEs
Carlo Gavazzi Automation: YL212* and YN115* are affected by multiple security vulnerabilities
The affected devices have security vulnerabilities that can be used to bypass authentication. Code can be executed on the devices through command injection and local file inclusion. Path traversal and modified schemata can be used to read sensitive informatio…
-
Critical max 9.6
METTLER TOLEDO: LabX Standard and Enterprise Report on External Component Analysis - v21.4
The vulnerabilities found in LabX Standard versions 21.3.22 - 21.4.23 are CVE-2025-69419, CVE-2026-0915, CVE-2025-15467, CVE-2026-4800, CVE-2026-33186, CVE-2026-39821, CVE-2026-33671 and are fixed in LabX Standard v21.4.25. The vulnerabilities found in LabX E…
first Aug 20, 2026 -
Critical max 9.3VDE-2026-093 1 CVE
SAUTER: modulo 6 and EY-modulo 5 Vulnerability in Firmware update mechanism allowing remote code execution
A vulnerability has been found in the firmware update process of SAUTER Building Controllers. The identified vulnerability could allow unauthorized code execution on affected controllers.
-
Critical max 9.8VDE-2026-083 2 CVEs
Weidmueller: Security routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G are affected by multiple vulnerabilities
Weidmueller security routers IE-SR-2TX-WL and IE-SR-2TX-WL-4G are affected by an unauthenticated remote code execution vulnerability. IE-SR-2TX-WL-4G routers are also affected by a SMS password authorization bypass vulnerability. Weidmueller has released new …
-
Critical max 9.8VDE-2025-056 3 CVEs
Phoenix Contact: Improper Input Validation Vulnerabilities in PLCnext Firmware
This advisory addresses multiple security vulnerabilities in PLCnext firmware versions prior to 2026.0.3. The vulnerabilities may allow unauthenticated attackers to cause denial of service, trigger unexpected system behavior, or execute unauthorized SQL queri…
-
Critical max 9.8VDE-2026-008 20 CVEs
Phoenix Contact: Multiple vulnerabilities in the firmware of CHARX SEC3xxx charging controllers
Multiple vulnerabilities have been identified in the firmware of CHARX SEC-3xxx EV charging controllers, including the CHARX SEC-3000, SEC-3050, SEC-3100, and SEC-3150 models. The flaws could allow attackers to compromise the devices remotely, resulting in a …
-
Critical max 9.8VDE-2026-031 1 CVE
WAGO: Early-Boot Diagnostic Exposure in WAGO System I/O Field Devices
Certain devices in the WAGO System I/O Field series enable an internal diagnostic capability during the initial stages of system startup. This behavior, which is not part of the publicly documented feature set, briefly allows access to system functions before…
-
Critical max 9.8
MBS: Several security vulnerabilities in the UGW web GUI
The MBS Universal Gateways (UGW-A-Series, UGW-X-Series) connect devices using various digital communication protocols within the field of building automation. Several security vulnerabilities have been identified in the UGW web GUI and the underlying firmware…
first Jun 3, 2026 -
Critical max 10.0VDE-2026-049 20 CVEs
Balluff GmbH: Multiple Vulnerabilities Affecting BNI EGW-720-007-K095 and BAV MA-NC-00025-01
Security advisory for Balluff BNI EGW-720-007-K095 and BAV MA-NC-00025-01 firmware versions prior to 2.4.1. This advisory covers multiple vulnerabilities affecting software components used by the device firmware.
-
Critical max 9.8
TURCK: Multiple Vulnerabilities in Managed Ethernet Switches
Multiple vulnerabilities have been identified in the TBEN-Lx-SE-M2 firmware prior to version 2.1.2.0 in Managed Ethernet Switches.
-
Critical max 9.8VDE-2026-064 21 CVEs
METTLER TOLEDO: LabX Standard Report on External Component Analysis - v21.3
Multiple vulnerabilities have been discovered in LabX Standard v21.3.22. Most of the vulnerabilities are fixed in LabX Standard v21.4.23. The Vulnerabilities CVE-2025-69419, CVE-2026-0915, CVE-2025-15467 and CVE-2025-58187 are not yet fixed. The fix will be a…
-
Critical max 9.1
Helmholz: Multiple Vulnerabilities in myREX24V2/myREX24V2.virtual
Multiple vulnerabilities have been discovered in Helmholz myREX24V2/myREX24V2.virtual that could allow RCE, SQLi or information leakage.
first Apr 13, 2026 -
Critical max 9.3
Endress+Hauser: sudo vulnerability affects Endress+Hauser MCS200HW
The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.
-
Critical max 9.1VDE-2026-030 5 CVEs
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow RCE, SQLi or information leakage.
-
Critical max 8.6VDE-2026-021 45 CVEs
WAGO: Multiple Vulnerabilities in WAGO VC Hub
The VC Hub incorporates the Magick.NET‑Q16‑AnyCPU component, derived from ImageMagick, to process user‑uploaded images and generate thumbnails within the projects image library. Only authenticated users with the Design Project Permission can upload images.
-
Critical max 9.9VDE-2026-010 2 CVEs
WAGO: Multiple Vulnerabilities in WAGO Solution Builder and WAGO Device Sphere
Multiple vulnerabilities have been identified in WAGO Solution Builder and WAGO Device Sphere that affect components responsible for authentication and system communication.
-
Critical max 9.8VDE-2026-024 2 CVEs
MB connect line: Multiple Vulnerabilities in mbCONNECT24/mymbCONNECT24
Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow unauthenticated RCE or SQLi.
-
Critical max 9.8VDE-2026-025 2 CVEs
Helmholz: Multiple Vulnerabilities in myREX24V2 / myREX24V2.virtual
Multiple vulnerabilities have been discovered in Helmholz myREX24V2 / myREX24V2.virtual that could allow unauthenticated RCE or SQLi.
-
Critical max 10.0VDE-2026-020 1 CVE
WAGO: Vulnerability in managed switches
A vulnerability has been found affecting the Managed Switches of WAGO. An unauthenticated attacker can fully compromise the device via an undocumented function.
-
Critical max 9.8VDE-2025-079 4 CVEs
Janitza: Multiple vulnerabilities in UMG 96RM-E
An unauthenticated remote attacker can exploit several vulnerabilities in Janitza UMG 96RM-E devices to ultimately gain full system access and remote code execution.
-
Critical max 9.8
MB connect line: Multiple Vulnerabilities in MB connect line Products
Multiple vulnerabilities have been discovered in MB connect line products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the mbCONNECT24 and mymbCONNECT24 products. CVE-2024-45273 affects the mbNET/mbNET.rokey, mbCONNECT24, mymbCONNE…
first Oct 15, 2024 -
Critical max 9.8
Helmholz: Multiple Vulnerabilities in Helmholz products
Multiple vulnerabilities have been discovered in Helmholz products that could allow RCE or unauthorized file access. CVE-2024-45272 affects the myREX24V2 and myREX24V2.virtual products. CVE-2024-45273 affects the REX 200/REX 250, myREX24V2, myREX24V2.virtual …
first Oct 15, 2024