Skip to contentSiemens Simatic S7-1500 Tm Mfp vulnerabilities
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morebpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loadedCVE-2026-23310Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moreipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()CVE-2026-23304Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moresmb: client: Don't log plaintext credentials in cifs_set_cifscredsCVE-2026-23303Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenet: annotate data-races around sk->sk_{data_ready,write_space}CVE-2026-23302Fix available4.7 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet: ipv6: fix panic when IPv4 route references loopback IPv6 nexthopCVE-2026-23300Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morescsi: core: Fix refcount leak for tagset_refcntCVE-2026-23296Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morescsi: target: Fix recursive locking in __configfs_open_file()CVE-2026-23292Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenfc: pn533: properly drop the usb interface reference on disconnectCVE-2026-23291Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet: usb: pegasus: validate USB endpointsCVE-2026-23290Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morewifi: libertas: fix use-after-free in lbs_free_adapter()CVE-2026-23281Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morewifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()CVE-2026-23279Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: nf_tables: always walk all pending catchall elementsCVE-2026-23278Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmitCVE-2026-23277Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenetfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labelsCVE-2026-23274Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moremacvlan: observe an RCU grace period in macvlan_common_newlink() error pathCVE-2026-23273Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: nf_tables: unconditionally bump set->nelems before insertionCVE-2026-23272Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moreperf: Fix __perf_event_overflow() vs perf_remove_from_context() raceCVE-2026-23271Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocksCVE-2026-23270Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet: add proper RCU protection to /proc/net/ptypeCVE-2026-23255Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremedia: dvb-core: fix wrong reinitialization of ringbuffer on reopenCVE-2026-23253Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet/sched: act_gate: snapshot parameters with RCU on replaceCVE-2026-23245Fix available7.8 High
- linux, linux kernel, siemens ruggedcom rst2428p (6gk6242-6pa00) +6 more +8 morenetfilter: nf_tables: fix use-after-free in nf_tables_addchain()CVE-2026-23231Public exploitFix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet/sched: cls_u32: use skb_header_pointer_careful()CVE-2026-23204Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morebtrfs: do not strictly require dirty metadata threshold for metadata writepagesCVE-2026-23157Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenet: fix segmentation of forwarding fraglist GROCVE-2026-23154Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morebtrfs: send: check for inline extents in range_is_hole_in_parent()CVE-2026-23141Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moreio_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loopCVE-2026-23113Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moremm/hugetlb: fix hugetlb_pmd_shared()CVE-2026-23100Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: Fix recvmsg() unconditional requeueCVE-2026-23066Fix available7.8 High
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreASN1_TYPE Type Confusion in the PKCS7_digest_from_attributes() functionCVE-2026-22796Fix available5.3 Medium
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreMissing ASN1_TYPE validation in PKCS#12 parsingCVE-2026-22795Fix available5.5 Medium
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreNULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex functionCVE-2025-69421Public exploitFix available7.5 High
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreMissing ASN1_TYPE validation in TS_RESP_verify_response() functionCVE-2025-69420Public exploitFix available7.5 High
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreOut of bounds write in PKCS12_get_friendlyname() UTF-8 conversionCVE-2025-69419Public exploitFix available7.4 High
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreUnauthenticated/unencrypted trailing bytes with low-level OCB function callsCVE-2025-69418Fix available4.0 Medium
- openssl, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreHeap out-of-bounds write in BIO_f_linebuffer on short writesCVE-2025-68160Fix available4.7 Medium
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +4 more +6 morenvme: fix admin request_queue lifetimeCVE-2025-68265Fix available7.8 High
- linux, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 morebinfmt_misc: restore write access before closing files opened by open_exec()CVE-2025-68239Fix available6.8 Medium
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +4 more +6 morenetfilter: nft_ct: add seqadj extension for natted connectionsCVE-2025-68206Fix available7.5 High
- linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +4 more +6 moreipv6: use RCU in ip6_xmit()CVE-2025-40135Fix available8.1 High
- linux, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreALSA: usb-audio: fix race condition to UAF in snd_usbmidi_freeCVE-2025-39997Fix availableNo score
- openssl, debian linux, siemens ruggedcom rst2428p +27 more +29 moreOut-of-bounds read & write in RFC 3211 KEK UnwrapCVE-2025-9230Fix available9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morewifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info workCVE-2025-39863Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morebpf: Forget ranges when refining tnum after JSETCVE-2025-39748Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morercu/nocb: Fix possible invalid rdp's->nocb_cb_kthread pointer accessCVE-2025-38704Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morepadata: Fix pd UAF once and for allCVE-2025-38584Fix available7.0 High
- gnu binutils, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 moreGNU Binutils BFD Library elf.c bfd_elf_get_str_section null pointer dereferenceCVE-2025-8224Fix available4.8 Medium
- gnu binutils, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 moreGNU Binutils elf.c bfd_elf_set_group_contents out-of-bounds writeCVE-2025-7546Fix available4.8 Medium
- gnu binutils, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +2 more +4 moreGNU Binutils objcopy.c copy_section heap-based overflowCVE-2025-7545Public exploitFix available4.8 Medium
- gnome libxml2, red hat cert-manager operator for red hat openshift 1.16, openshift compliance operator 1 +48 more +50 moreLibxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptrCVE-2025-7425Fix available7.8 High
- Show moreLoading…