[ Vendor · 52 CVEs ]
Siemens
CVEs affecting Siemens published in the last 30 days, plus any Siemens CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-110936 | 15 Oct 2026 | CVSS 6.7 | DLL search path flaw in Siemens Software CenterA vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries… | ExploitedFix |
| CVE-2026-89204 | 13 Oct 2026 | CVSS 5.4 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries… | |
| CVE-2026-89205 | 13 Oct 2026 | CVSS 6.3 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization… | |
| CVE-2026-89206 | 13 Oct 2026 | CVSS 6.3 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization… | |
| CVE-2026-89208 | 13 Oct 2026 | CVSS 5.3 | Siemens Capital Embedded AR Classic 431-422A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303)… | |
| CVE-2026-89197 | 13 Oct 2026 | CVSS 8.8 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the… | |
| CVE-2026-89198 | 13 Oct 2026 | CVSS 8.8 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize the filename… | |
| CVE-2026-89199 | 13 Oct 2026 | CVSS 8.8 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to sensitive… | |
| CVE-2026-89200 | 13 Oct 2026 | CVSS 6.7 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the… | |
| CVE-2026-89201 | 13 Oct 2026 | CVSS 7.5 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in… | |
| CVE-2026-89202 | 13 Oct 2026 | CVSS 6.5 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for… | |
| CVE-2026-89203 | 13 Oct 2026 | CVSS 4.3 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database… | |
| CVE-2026-72895 | 13 Oct 2026 | CVSS 7.7 | Siemens SIMATIC IPC BX-21AA vulnerability has been identified in SIMATIC IPC BX-21A (All versions < V31.01.13), SIMATIC IPC RW-543A (All versions < V1.1.4), SIMATIC IPC227G /… | |
| CVE-2026-78556 | 13 Oct 2026 | CVSS 7.4 | Siemens Industrial Edge App PublisherA vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly validate the… | |
| CVE-2026-78557 | 13 Oct 2026 | CVSS 8.3 | Siemens Industrial Edge App PublisherA vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape… | |
| CVE-2026-85114 | 13 Oct 2026 | CVSS 7.5 | Siemens .NET Client Library for SIMATIC S7 Webserver APIA vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do not… | |
| CVE-2026-85115 | 13 Oct 2026 | CVSS 5.5 | Siemens .NET Client Library for SIMATIC S7 Webserver APIA vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.62). Affected applications do not… | |
| CVE-2026-89196 | 13 Oct 2026 | CVSS 8.8 | Siemens RUGGEDCOM CROSSBOWA vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in… | |
| CVE-2026-63356 | 13 Oct 2026 | CVSS 6.1 | Siemens SIMATIC Drive Controller CPU 1504D TFAffected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messages on… | |
| CVE-2026-63357 | 13 Oct 2026 | CVSS 6.1 | Siemens SIMATIC Drive Controller CPU 1504D TFAffected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Trace page… | |
| CVE-2026-63353 | 13 Oct 2026 | CVSS 9.6 | Siemens SIMATIC Drive Controller CPU 1504D TFAffected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow… | |
| CVE-2026-63354 | 13 Oct 2026 | CVSS 9.6 | Siemens SIMATIC Drive Controller CPU 1504D TFAffected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace… | |
| CVE-2026-63355 | 13 Oct 2026 | CVSS 6.1 | Siemens SIMATIC Drive Controller CPU 1504D TFAffected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace… | |
| CVE-2026-63351 | 13 Oct 2026 | CVSS 6.1 | Siemens SIMATIC Drive Controller CPU 1504D TFAffected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before rendering… | |
| CVE-2026-63352 | 13 Oct 2026 | CVSS 6.1 | Siemens SIMATIC Drive Controller CPU 1504D TFAffected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page. This… | |
| CVE-2026-44414 | 13 Oct 2026 | CVSS 6.8 | Siemens Industrial Edge Cloud Device (IECD)A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit -… | |
| CVE-2026-44415 | 13 Oct 2026 | CVSS 9.1 | Siemens Industrial Edge Device Kit - arm64 V1.10Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote… | |
| CVE-2026-59241 | 13 Oct 2026 | CVSS 8.8 | Siemens SIMATIC WinCC V7.5A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC V8.1 (All… | |
| CVE-2026-63350 | 13 Oct 2026 | CVSS 9.6 | Siemens SIMATIC Drive Controller CPU 1504D TFAffected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an… | |
| CVE-2026-102073 | 13 Oct 2026 | CVSS 8.2 | Siemens APOGEE MBC (PPC) (BACnet)A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC)… | |
| CVE-2026-102074 | 13 Oct 2026 | CVSS 7.5 | Siemens APOGEE MBC (PPC) (BACnet)A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC)… | |
| CVE-2026-102075 | 13 Oct 2026 | CVSS 7.5 | Siemens APOGEE MBC (PPC) (BACnet)A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC)… | |
| CVE-2026-102076 | 13 Oct 2026 | CVSS 7.5 | Siemens APOGEE MBC (PPC) (BACnet)A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC)… | |
| CVE-2026-84854 | 6 Oct 2026 | CVSS 7.0 | wibu-systems-ag wibukeyIn the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause… | |
| CVE-2026-53362 | 4 Jul 2026 | CVSS 7.8 | Linux Kernel UnspecifiedIn the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data()… | ExploitedFix |
| CVE-2026-0257 | 13 May 2026 | CVSS 9.1 | Palo Alto Networks PAN-OS Authentication BypassAuthentication bypass vulnerabilities in the GlobalProtect portal and gateway of Palo Alto Networks PAN-OS® software allows the attacker to bypass… | Exploited |
| CVE-2026-0300 | 6 May 2026 | CVSS 9.8 | Palo Alto Networks PAN-OS Out-of-bounds WriteA buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software allows an… | Exploited |
| CVE-2026-31431 | 22 Apr 2026 | CVSS 7.8 | Linux Kernel Incorrect Resource Transfer Between SpheresIn the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit… | ExploitedFix |
| CVE-2025-61624 | 14 Apr 2026 | CVSS 6.5 | Fortinet Multiple Products Path TraversalAn Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4… | Exploited |
| CVE-2026-24858 | 27 Jan 2026 | CVSS 9.8 | Fortinet Multiple Products Authentication Bypass Using an Alternate Path or ChannelAn Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5… | Exploited |
| CVE-2025-25249 | 13 Jan 2026 | CVSS 9.8 | Fortinet Multiple Products Heap-based Buffer OverflowA heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11… | Exploited |
| CVE-2025-59718 | 9 Dec 2025 | CVSS 9.8 | Fortinet Multiple Products Improper Verification of Cryptographic SignatureA improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0… | Exploited |
| CVE-2025-13223 | 17 Nov 2025 | CVSS 8.8 | Google Chromium V8 Type ConfusionType Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2025-39964 | 13 Oct 2025 | CVSS 5.5 | Linux Kernel Race ConditionIn the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes… | ExploitedFix |
| CVE-2025-10585 | 24 Sep 2025 | CVSS 9.8 | Google Chromium V8 Type ConfusionType confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Exploited |
| CVE-2025-39682 | 5 Sep 2025 | CVSS 9.8 | Linux Kernel Improper Check for Unusual or Exceptional ConditionsIn the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must… | ExploitedFix |
| CVE-2024-50302 | 19 Nov 2024 | CVSS 5.5 | Linux Kernel Use of Uninitialized ResourceIn the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by… | ExploitedFix |
| CVE-2022-2586 | 8 Jan 2024 | CVSS 7.8 | Linux Kernel Use-After-FreeIt was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was… | ExploitedFix |
| CVE-2023-44487 | 10 Oct 2023 | CVSS 7.5 | HTTP/2 Rapid Reset AttackThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as… | ExploitedFix |
| CVE-2023-4911 | 3 Oct 2023 | CVSS 7.8 | GNU C Library Buffer OverflowA buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue… | ExploitedFix |
| CVE-2016-8562 | 18 Nov 2016 | CVSS 7.5 | Siemens SIMATIC CP 1543-1 Improper Privilege ManagementA vulnerability has been identified in SIMATIC CP 1543-1 (All versions < V2.0.28), SIPLUS NET CP 1543-1 (All versions < V2.0.28). Under special… | ExploitedFix |
| CVE-2014-0160 | 7 Apr 2014 | CVSS 7.5 | OpenSSL Information DisclosureThe (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote… | ExploitedFix |