CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.23)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Moxa DACenter Versions 1.4 and older related to unquoted search paths.
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior related to the storage of the admin password. The password is encrypted with a static key hard-coded in the program, allowing attackers to reverse it.
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior related to directory traversal/file upload error that allows an attacker to upload and unpack a zip file.
An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior, allowing an attacker to traverse the file system and extract files, potentially leading to information disclosure.
An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files.
An issue exists in Rockwell Automation Allen-Bradley MicroLogix 1100 devices, in versions 14.000 and prior, where user credentials are sent to the web server in clear text. This may allow an attacker to intercept these credentials if they can observe traffic between the web browser and the server.
An issue was discovered in Moxa SoftCMS versions prior to Version 1.6 related to improper input validation. An attacker could provide unexpected values, leading to program crashes or excessive resource consumption resulting in a denial-of-service condition.
An issue was discovered in Siemens SICAM PAS before version 8.00 related to storing passwords in a recoverable format. An authenticated local attacker with certain privileges could possibly reconstruct the passwords of users for accessing the database.
A limitation in Moxa ioLogik devices restricts users to using short passwords. This affects multiple models and firmware versions, potentially lowering security.
A stack-based buffer overflow vulnerability was discovered in Fatek Automation PLC WinProladder Version 3.11 Build 14701. The issue occurs when the software application connects to a malicious server, resulting in a Structured Exception Handler (SEH) overwrite condition that may allow remote code execution.
An issue was discovered in Schneider Electric Magelis HMI devices, including various panel models, which may allow an attacker to disrupt a targeted web server. This can result in denial of service due to uncontrolled resource consumption.
An issue exists in Moxa ioLogik devices regarding the transmission of passwords in a format that is not sufficiently secure. This affects multiple models and firmware versions, potentially leading to unauthorized access.
An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, QJ71E71-B5, and QJ71E71-B2, related to the transmission of weakly encrypted passwords to MELSEC-Q PLCs.
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older related to insufficient verification of whether a request was intentionally provided by the user. This leads to a vulnerability to Cross-Site Request Forgery (CSRF) attacks.
An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, QJ71E71-B5, and QJ71E71-B2, which may allow a remote attacker to connect to the PLC via Port 5002/TCP and cause a denial of service, requiring the PLC to be reset to resume operation.
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older related to the use of a hard-coded username without a password, allowing an attacker to access the system without authentication.
An issue was discovered in Moxa SoftCMS versions prior to 1.6 that allows a specially crafted URL request sent to the SoftCMS ASP Webserver to cause a double free condition. This can enable an attacker to modify memory locations and potentially lead to denial of service or execution of arbitrary code.
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands.
An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0 related to improper sanitization of web server URL inputs, which may allow cross-site scripting vulnerabilities.
An issue was discovered in Schneider Electric Unity PRO prior to V11.1, allowing Unity projects to be compiled as x86 instructions. These instructions are executed directly by the PLC Simulator, enabling the execution of malicious code.