16
CVEs
4
Critical
10
High
0
KEV
0
PoC
14
Unpatched C/H
6.2%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
4
HIGH
10
MEDIUM
1
LOW
1
Monthly CVE Trend
Affected Products (30)
Teamcenter Visualization
143
Jt2Go
129
Debian Linux
91
Tecnomatix Plant Simulation
76
Telecontrol Server Basic
75
Simcenter Femap
67
Sinec Infrastructure Network Services
64
Fedora
58
Sinema Remote Connect Server
53
Scalance W1750D Firmware
51
Parasolid
50
Sinec Nms
42
Ubuntu Linux
36
Solid Edge Se2023
35
Sppa T3000 Ms3000 Migration Server
35
Solid Edge
34
Sinec Ins
33
Cloud Backup
33
Wincc
31
Clustered Data Ontap
30
Jt Utilities
29
Instant
28
Jt Open Toolkit
26
Arubaos
26
Node.js
26
Comos
25
Simatic Pcs7
25
Simatic Pcs Neo
24
Simatic Wincc
23
Splunk
22
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-62645 | Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware before V2.70) lets remote unauthenticated attackers derive valid current and past web-interface session IDs from information the web UI leaks, then reuse them to hijack sessions and gain full device access. The session identifier is predictable/calculable rather than cryptographically random, collapsing the login barrier. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 reflects unauthenticated network reach with high confidentiality, integrity, and availability impact. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-62647 | Authentication impersonation in Siemens Reyrolle 7SR5 protection relays (all versions below V2.70) arises because session identifiers and other security-relevant values are produced by a random number generator that is not seeded from a True Random Number Generator, yielding a predictable output sequence. An unauthenticated remote attacker who predicts these values can forge a valid session and impersonate a legitimate authenticated user, gaining unauthorized access to the device. No public exploit identified at time of analysis; the flaw is remotely reachable and unauthenticated per the CVSS 4.0 vector. | CRITICAL | 9.3 | 0.3% | 47 |
No patch
|
| CVE-2026-67367 | Arbitrary file read in Siemens SIMOVE Fleetmanager (V3.1 before V3.1.13, V3.2 before V3.2.4, V3.3 before V3.3.2, V4.0 before V4.0.1) and SIPLANT (V1.7, V2.2, V3.0 all versions; V3.1 before V3.1.4) allows a remote unauthenticated attacker to traverse directories through the embedded HTTP server's file-serving endpoint and retrieve any file from the host operating system. Because no credentials are required and the payload targets the file path directly, an attacker can harvest credential stores, private keys, and configuration secrets that enable follow-on compromise. This maps to CWE-23 (relative path traversal); there is no public exploit identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.2 | 0.8% | 47 |
No patch
|
| CVE-2026-62646 | Authentication bypass in Siemens Reyrolle 7SR5 protection relays (all firmware versions below V2.70) stems from session identifiers generated with insufficient randomness, producing low-entropy tokens that a remote attacker can predict or brute-force. By deriving a valid session identifier, an unauthenticated attacker can impersonate a legitimate session and gain access to protected relay functions. No public exploit identified at time of analysis; the issue is fixed in V2.70 per Siemens advisory SSA-142885. | CRITICAL | 9.1 | 0.3% | 46 |
No patch
|
| CVE-2026-50093 | Unrestricted file upload via the OIS web module in Siemens Siveillance Control and Siveillance Control Pro enables an adjacent, low-privileged attacker to upload and execute malicious server-side content, achieving root access on the OIS host. Both V3.0 and V4.0 product lines across the Control and Control Pro variants are affected, covering four separate CPE entries. Siemens has released patched builds for all affected branches per advisory SSA-254516; no public exploit or active exploitation has been identified at time of analysis. | HIGH | 8.9 | 0.2% | 45 |
No patch
|
| CVE-2026-80465 | SAML response signature validation is absent or insufficient in the Mendix SAML module across all Mendix 9.24, 10, and 11 compatible releases prior to their respective patches, enabling unauthenticated remote attackers to forge SAML assertions and hijack arbitrary user sessions under specific SSO configurations. The flaw (CWE-347) is conditional on deployment configuration and requires passive user participation in an active SSO flow, moderating its exploitability from a mass-opportunistic standpoint. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 8.8 | 0.2% | 44 |
No patch
|
| CVE-2026-62648 | Out-of-bounds write in Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) allows unauthenticated remote attackers to crash and reboot the device by sending a crafted HTTP request containing an oversized URL component. The flaw exists in pre-authentication HTTP message processing, meaning no credentials are required; a single malicious request can trigger a forced device reboot and a sustained denial-of-service condition. No public exploit code or CISA KEV listing has been identified at time of analysis, but the OT/substation deployment context significantly amplifies the operational impact of availability loss. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-62649 | Denial-of-service via resource exhaustion in the Siemens Reyrolle 7SR5 protection relay (all firmware versions before V2.70) allows an unauthenticated remote attacker to crash and reboot the entire device by flooding its embedded web server with a high volume of concurrent HTTP requests. Because the web server imposes no concurrency limits or allocation throttles (CWE-770), the device's constrained embedded resources are exhausted, triggering a full system restart rather than just a web-service failure. In OT/ICS environments where Reyrolle 7SR5 relays perform electrical protection functions, a forced restart creates an operational availability gap that may have safety-critical consequences during fault events. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-62650 | Privilege escalation to administrative level is possible in the Siemens Reyrolle 7SR5 protection relay (all versions prior to V2.70) via improper enforcement of server-side RBAC controls in its web-based management interface. An authenticated attacker with low-privileged credentials can manipulate HTTP request data to bypass authorization checks, gaining administrative access to the relay's configuration and control functions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility elevate practical risk for any internet- or OT-network-exposed deployment. | HIGH | 8.7 | 0.3% | 44 |
No patch
|
| CVE-2026-34223 | Client Code Execution in Siemens Desigo CC building management clients allows a low-privileged attacker to execute injected scripts and write arbitrary files to the client operating system by enticing an operator to open a maliciously crafted graphics document. All versions of the ClickOnce, Flex, and Installed Client variants across the V6, V7, V8, and V9 product lines are confirmed affected per Siemens SSA-330084. The subsequent-system impact (SC:H/SI:H/SA:H in the vendor-supplied CVSS 4.0 vector) reflects the documented lateral movement risk within OT environments. No public exploit is identified at time of analysis. | HIGH | 8.6 | 0.1% | 43 |
No patch
|
| CVE-2026-58113 | Reflected XSS in Siemens Teamcenter's authentication redirect endpoint (/auth/) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an already-authenticated user by delivering a crafted URL. Four active Teamcenter release trains are affected across versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. Successful exploitation enables the attacker to act within the victim's live Teamcenter PLM session - accessing engineering data, modifying records, or pivoting laterally - with no public exploit identified at time of analysis. | HIGH | 8.5 | 0.2% | 43 |
No patch
|
| CVE-2026-62653 | Memory corruption in Siemens Reyrolle 7SR5 digital protection relays (all versions below V2.70) allows a physically-present, unauthenticated attacker to crash the device or potentially execute arbitrary code by sending malformed input over a proprietary communication protocol exposed exclusively during the device's special firmware-update mode. Siemens confirmed the flaw via advisory SSA-142885 and released V2.70 as the fix. No public exploit code or active exploitation has been identified at time of analysis. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2026-66155 | Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis. | HIGH | 7.0 | 0.2% | 35 |
No patch
|
| CVE-2026-62654 | Unsigned code execution on Siemens Reyrolle 7SR5 protection relays (all firmware versions before V2.70) is possible when an attacker with physical access triggers a special maintenance boot mode via a hardware key sequence. In this mode the relay unconditionally downloads and executes code from a network server with no cryptographic signature or integrity verification, fully satisfying CWE-494. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; risk is bounded by the physical-access prerequisite but is severe once that barrier is crossed in OT substation environments. | HIGH | 7.0 | 0.1% | 35 |
No patch
|
| CVE-2026-62652 | Unstripped debug symbols in Siemens Reyrolle 7SR5 protection relay firmware (all versions prior to V2.70) expose internal function names, type definitions, and structure layouts to any party who downloads the publicly available firmware update packages. This does not directly compromise deployed devices but substantially reduces the skill and effort required for an attacker to identify exploitable weaknesses through static firmware analysis. No public exploit or active exploitation has been identified; Siemens has released firmware V2.70 as the fix per advisory SSA-142885. | MEDIUM | 6.9 | 0.2% | 35 |
No patch
|