Pilz PSIRT
organizationDE01
references
Other names and identifiers for this entity.
pilz_psirtDE security@pilz.com
02
assessed vulnerabilities (77)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-57472US | — | — | ||
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the X… | ||||
| CVE-2026-57471US | — | — | ||
Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the file management functionality of the X… | ||||
| CVE-2026-57469US | — | — | ||
Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a… | ||||
| CVE-2026-13198US | — | — | ||
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the event notification funct… | ||||
| CVE-2026-13197US | — | — | ||
Nozomi Networks Labs identified a CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in the configuration and proces… | ||||
| CVE-2026-13196US | — | — | ||
Nozomi Networks Labs identified a CWE-787: Out-of-bounds Write vulnerability in the process-image management functionality of KUNBUS piControl in version 2.6.2 that allows a local… | ||||
| CVE-2023-45796US | — | — | ||
A stored cross-site scripting vulnerability in the Runtime component of Pilz PASvisu before 1.14.1 and PMI v8xx up to and including 2.0.33992 allows a low-privileged remote unauthe… | ||||
| CVE-2023-45795US | — | — | ||
A cross-site scripting vulnerability in the Builder Component of Pilz PASvisu before 1.14.1 allows a local unauthenticated attacker to inject malicious javascript and gain full con… | ||||
| CVE-2026-46300US | high7.8 | Exploit | ||
In the Linux kernel, the following vulnerability has been resolved:
net: skbuff: preserve shared-frag marker during coalescing
skb_try_coalesce() can attach paged frags from @fro… | ||||
| CVE-2026-43284US | — | Exploit | ||
In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp: avoid in-place decrypt on shared skb frags
MSG_SPLICE_PAGES can attach pages from a pipe directly t… | ||||
| CVE-2026-31431US | —OT critical | KEV | ||
In the Linux kernel, the following vulnerability has been resolved:
crypto: algif_aead - Revert to operating out-of-place
This mostly reverts commit 72548b093ee3 except for the c… | ||||
| CVE-2018-25193US | —OT elevated | — | ||
Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections. Attackers can repe… | ||||
| CVE-2025-12383US | high7.4 | — | ||
In Eclipse Jersey versions 2.45, 3.0.16, 3.1.9 a race condition can cause ignoring of critical SSL configurations - such as mutual authentication, custom key/trust stores, and othe… | ||||
| CVE-2025-61795US | — | — | ||
Improper Resource Shutdown or Release vulnerability in Apache Tomcat.
If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copi… | ||||
| CVE-2025-51495US | — | Exploit | ||
An integer overflow vulnerability exists in the WebSocket component of Mongoose 7.5 thru 7.17. By sending a specially crafted WebSocket request, an attacker can cause the applicati… | ||||
| CVE-2025-41656US | —OT elevated | Exploit | ||
An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by d… | ||||
| CVE-2025-41648US | — | — | ||
An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the Industr… | ||||
| CVE-2025-48988US | — | Exploit | ||
Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.
This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10.1.4… | ||||
| CVE-2025-36558US | — | — | ||
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable to a cross-site-scripting attack via the sso_token used for authentication. If an attacker provides the user with a PiCtory… | ||||
| CVE-2025-35996US | — | — | ||
KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints. That filename is later… | ||||