Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78557 | high | 8.3 | No | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or... | 2026-10-15 |
| CVE-2026-63357 | medium | 6.1 | No | Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before rendering it on the Tr... | 2026-10-15 |
| CVE-2026-63356 | medium | 6.1 | No | Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before including them in error messa... | 2026-10-15 |
| CVE-2026-63355 | medium | 6.1 | No | Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the... | 2026-10-15 |
| CVE-2026-63353 | critical | 9.6 | No | Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This co... | 2026-10-15 |
| CVE-2026-63352 | medium | 6.1 | No | Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering it on the Trace page... | 2026-10-15 |
| CVE-2026-63351 | medium | 6.1 | No | Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported CSV trace files before... | 2026-10-15 |
| CVE-2026-63350 | critical | 9.6 | No | Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engi... | 2026-10-15 |
| CVE-2026-44415 | critical | 9.1 | No | Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remot... | 2026-10-15 |
| CVE-2026-44414 | medium | 6.8 | No | A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device... | 2026-10-15 |
| CVE-2026-102076 | high | 7.5 | No | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (... | 2026-10-15 |
| CVE-2026-102075 | high | 7.5 | No | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (... | 2026-10-15 |
| CVE-2026-102074 | high | 7.5 | No | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (... | 2026-10-15 |
| CVE-2026-102073 | high | 8.2 | No | A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (... | 2026-10-15 |
| CVE-2026-89124 | medium | 4.3 | No | Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionali... | 2026-10-15 |
| CVE-2026-89122 | medium | 6.1 | No | SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft... | 2026-10-15 |
| CVE-2026-89121 | medium | 4.7 | No | SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business objec... | 2026-10-15 |
| CVE-2026-89120 | high | 7.1 | No | A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be... | 2026-10-15 |
| CVE-2026-89118 | medium | 5.3 | No | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application info... | 2026-10-15 |
| CVE-2026-89117 | medium | 6.1 | No | SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect... | 2026-10-15 |