CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.21)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0 related to improper sanitization of web server URL inputs, which may allow cross-site scripting vulnerabilities.
An issue was discovered in Schneider Electric Unity PRO prior to V11.1, allowing Unity projects to be compiled as x86 instructions. These instructions are executed directly by the PLC Simulator, enabling the execution of malicious code.
An issue exists in Schneider Electric ConneXium firewalls that can trigger a stack-based buffer overflow during the SNMP login authentication process, potentially allowing an attacker to remotely execute code.
An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5, and prior. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.
An issue was discovered in Kabona AB WebDatorCentral (WDC) application prior to Version 3.4.0 related to the lack of authentication attempt limits, which may allow a brute force attack method.
An issue was discovered in Moxa EDR-810 Industrial Secure Router that allows a malicious user to access configuration and log files by accessing a specific URL on the web server.
An issue was discovered in Ecava IntegraXor Version 5.0.413.0 related to SQL injection vulnerability in the web server. Unsanitized parameters may lead to unauthorized access to the database.
An issue was discovered in Siemens ETA4 firmware (all versions prior to Revision 08) of the SM-2558 extension module. Specially crafted packets sent to Port 2404/TCP could cause the affected device to go into defect mode.
An issue was discovered in Schneider Electric PowerLogic PM8ECC device 2.651 and older, where undocumented hard-coded credentials allow access to the device.
An issue was discovered on Schneider Electric IONXXXX series power meters, including ION73XX, ION75XX, ION76XX, ION8650, ION8800, and PM5XXX. No authentication is configured by default, allowing unauthorized users to access the device management portal and make configuration changes.
An issue was discovered on Schneider Electric IONXXXX series power meters regarding the lack of CSRF Token generation to authenticate the user during a session. Successful exploitation of this vulnerability can allow unauthorized configuration changes to be made and saved.
Multiple instances of heap-based buffer overflows were discovered in Delta Electronics WPLSoft, ISPSoft, and PMSoft, which may allow the execution of arbitrary code or denial of service.
An issue was discovered in CA Unified Infrastructure Management Version 8.47 and earlier related to improper handling of external input for pathname construction. The software does not properly neutralize sequences like '..', which can lead to access outside of the restricted directory.
An issue was discovered in Delta Electronics WPLSoft, ISPSoft, and PMSoft related to multiple instances of out-of-bounds write conditions. This may allow malicious files to be read and executed by the affected software.
An issue was discovered in OmniMetrix OmniView, Version 1.2 related to insufficient password requirements. This may allow an attacker to gain access to the web application by brute forcing account passwords.
An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2 and Automation FV Designer Version 1.2.8.0, allowing an attacker to trigger a stack-based buffer overflow by sending additional valid packets. This could lead to a crash and also allows for remote buffer overflow on the Fatek Communication Server.
An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2, and Automation FV Designer Version 1.2.8.0, allowing an attacker to send additional valid packets. This could lead to a crash or execution of arbitrary code due to improper restriction of operations within the bounds of a memory buffer.
An issue was discovered in the OmniView web application, version 1.2, related to the transmission of credentials using the HTTP protocol. This could allow an attacker to sniff these credentials, leading to account compromise.
An issue was discovered in Locus Energy LGate prior to version 1.05H related to improper validation of data in the PHP script managing energy meter parameters. This affects models LGate 50, LGate 100, LGate 101, LGate 120, and LGate 320.
An issue was discovered in Sauter NovaWeb web HMI related to a protection mechanism that relies on the existence or values of a cookie. However, it does not properly ensure that the cookie is valid for the associated user.