4
CVEs
0
Critical
4
High
0
KEV
0
PoC
4
Unpatched C/H
0.0%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
4
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Diaenergie
86
Infrasuite Device Master
30
Cncsoft G2
16
Dialink
14
Dopsoft
13
Diascreen
12
Tpeditor
12
Cncsoft Screeneditor
10
Cncsoft
9
Delta Industrial Automation Dopsoft
7
Ispsoft
6
Cncsoft B
5
Wplsoft
5
Industrial
4
As320T
4
Asda Soft
4
Diaview
3
Screeneditor
3
Drasimucad
3
Dvp80Es3
3
Cnssoft Screeneditor
2
Devicenet Builder
2
Commgr2
2
Dvp 12Se
2
Dx 2100 L1 Cn Firmware
2
Dtmsoft
1
Industrial Automation Commgr
1
Dvp32Es200Re Firmware
1
Dx 2100L1 Cn Firmware
1
Dvp32Es200R Firmware
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-78314 | SQL injection in Delta DIAEnergie versions up to and including v1.11.00.002 enables authenticated network-accessible attackers to escalate from data manipulation to remote code execution on the underlying host. Confirmed by vendor advisory Delta PCSA-2026-00015 and EUVD-2026-64759, the vulnerability (CWE-89) carries a CVSS 3.1 score of 8.8, reflecting low attack complexity and full CIA impact. No public exploit or CISA KEV listing has been identified at time of analysis, but the RCE pathway in an energy management system warrants priority remediation. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-78315 | SQL Injection in Delta Electronics DIAEnergie versions up to and including 1.11.00.002 enables a low-privileged remote attacker to achieve full remote code execution on the underlying server. Confirmed by vendor advisory Delta-PCSA-2026-00015 and ENISA EUVD-2026-64760, the flaw (CWE-89) stems from unsanitized user input passed directly to backend SQL queries, with the database engine serving as the execution bridge to the OS. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible RCE impact in an industrial energy management context elevates this to a high-priority remediation target. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-78316 | SQL injection in Delta DIAEnergie versions up to and including v1.11.00.002 enables authenticated network-based attackers to achieve remote code execution on the underlying server. Carrying a CVSS base score of 8.8 with low-privilege, low-complexity network access required, this flaw poses serious risk to operational technology environments that depend on this energy management platform for monitoring and control. No public exploit code or CISA KEV listing has been identified at time of analysis, though Delta Electronics has self-disclosed the issue via vendor advisory PCSA-2026-00015. | HIGH | 8.8 | 0.7% | 45 |
No patch
|
| CVE-2026-78317 | SQL injection in Delta DIAEnergie versions up to and including 1.11.00.002 enables low-privileged authenticated remote attackers to achieve full remote code execution on the host system. The flaw (CWE-89) is network-exploitable with low complexity, affecting an industrial energy management platform used in OT environments where RCE carries significant operational risk. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vendor has published a security advisory. | HIGH | 8.8 | 0.7% | 45 |
No patch
|