CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Moxa MiiNePort E1 versions prior to 1.8, E2 versions prior to 1.4, and E3 versions prior to 1.1. An attacker may be able to brute force an active session cookie to be able to download configuration files.
An issue was discovered in Rockwell Automation Logix5000 Programmable Automation Controller versions FRN 16.00 through 21.00 related to the processing of malformed CIP packets. An attacker may exploit this vulnerability to overflow a stack-based buffer, potentially allowing code execution on the controller or causing a fault that results in a denial of service.
An issue exists in Rockwell Automation Allen-Bradley MicroLogix 1100 devices, in versions 14.000 and prior, where user credentials are sent to the web server in clear text. This may allow an attacker to intercept these credentials if they can observe traffic between the web browser and the server.
An issue was discovered in Moxa SoftCMS versions prior to 1.6 related to improper input sanitization. A remote attacker may gain access to SoftCMS with administrator privileges through specially crafted input (SQL INJECTION).
An issue was discovered in Moxa SoftCMS versions prior to Version 1.6 related to improper input validation. An attacker could provide unexpected values, leading to program crashes or excessive resource consumption resulting in a denial-of-service condition.
An issue was discovered in Siemens SICAM PAS before version 8.00 related to a factory account with hard-coded passwords. Attackers might gain privileged access to the database over Port 2638/TCP.
An issue was discovered in Siemens SICAM PAS before version 8.00 related to storing passwords in a recoverable format. An authenticated local attacker with certain privileges could possibly reconstruct the passwords of users for accessing the database.
A limitation in Moxa ioLogik devices restricts users to using short passwords. This affects multiple models and firmware versions, potentially lowering security.
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older related to insufficient safeguards in the application's database for protecting credentials.
A stack-based buffer overflow vulnerability was discovered in Fatek Automation PLC WinProladder Version 3.11 Build 14701. The issue occurs when the software application connects to a malicious server, resulting in a Structured Exception Handler (SEH) overwrite condition that may allow remote code execution.
An issue was discovered in Schneider Electric Magelis HMI devices, including various panel models, which may allow an attacker to disrupt a targeted web server. This can result in denial of service due to uncontrolled resource consumption.
An issue exists in Moxa ioLogik devices regarding the transmission of passwords in a format that is not sufficiently secure. This affects multiple models and firmware versions, potentially leading to unauthorized access.
An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, QJ71E71-B5, and QJ71E71-B2, related to the transmission of weakly encrypted passwords to MELSEC-Q PLCs.
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older related to insufficient verification of whether a request was intentionally provided by the user. This leads to a vulnerability to Cross-Site Request Forgery (CSRF) attacks.
An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, QJ71E71-B5, and QJ71E71-B2, which may allow a remote attacker to connect to the PLC via Port 5002/TCP and cause a denial of service, requiring the PLC to be reset to resume operation.
An issue was discovered in IBHsoftec S7-SoftPLC prior to version 4.12b related to a buffer overflow in PLC controllers. Object memory can read a network packet larger than the available space, leading to a Heap-based Buffer Overflow.
An issue was discovered in Moxa OnCell OnCellG3470A-LTE and various AWK and WAC series devices that allows a user to execute arbitrary OS commands on the server.
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older related to the use of a hard-coded username without a password, allowing an attacker to access the system without authentication.
An issue was discovered in Moxa SoftCMS versions prior to 1.6 that allows a specially crafted URL request sent to the SoftCMS ASP Webserver to cause a double free condition. This can enable an attacker to modify memory locations and potentially lead to denial of service or execution of arbitrary code.
An issue was discovered in Lynxspring JENEsys BAS Bridge versions 1.1.8 and older. A user with read-only access can send commands to the software and the application will accept those commands.