Skip to contentSiemens vulnerabilities
Products
Show 140 moreShow less
- Scalance M876-4 (nam)36
- Scalance S615 Lan-router36
- Solid Edge Se202336
- Tecnomatix Plant Simulation V220136
- Ruggedcom Rm1224 Lte(4g) Eu35
- Ruggedcom Rm1224 Lte(4g) Nam35
- Scalance M876-335
- Scalance Mum853-1 (eu)35
- Scalance Mum856-1 (eu)35
- Scalance Mum856-1 (row)35
- Simatic Wincc35
- Sppa-t3000 Ms3000 Migration Server35
- Sppa-t3000 Ms3000 Migration Server35
- Tecnomatix Plant Simulation35
- Simatic S7-plcsim Advanced33
- Solid Edge Se202133
- Jt Utilities32
- Jt Utilities32
- Scalance Wam766-1 Eec (us)32
- Scalance Wam766-1 (us)32
- Comos31
- Parasolid V34.031
- Scalance M812-1 Adsl-router31
- Scalance M816-1 Adsl-router31
- Scalance M876-431
- Scalance S615 Eec Lan-router31
- Scalance Wam763-131
- Scalance Wum763-131
- Scalance Xch32831
- Scalance Xcm32431
- Scalance Xcm32831
- Scalance Xcm33231
- Scalance Xrh334 (24 V Dc, 8xfo, Cc)31
- Scalance Xrm334 (230 V Ac, 12xfo)31
- Scalance Xrm334 (230v Ac, 2x10g, 24xsfp, 8xsfp+)31
- Scalance Xrm334 (230 V Ac, 8xfo)31
- Scalance Xrm334 (24 V Dc, 12xfo)31
- Scalance Xrm334 (24v Dc, 2x10g, 24xsfp, 8xsfp+)31
- Scalance Xrm334 (24 V Dc, 8xfo)31
- Scalance Xrm334 (2x230 V Ac, 12xfo)31
- Scalance Xrm334 (2x230v Ac, 2x10g, 24xsfp, 8xsfp+)31
- Scalance Xrm334 (2x230 V Ac, 8xfo)31
- Scalance Wam766-130
- Scalance Wam766-1 Eec30
- Scalance Wum766-130
- Scalance Wum766-1 (usa)30
- Jt Open Toolkit29
- Ruggedcom Crossbow29
- Simatic Ipc647e29
- Simatic Ipc847e29
- Solid Edge Se202229
- Teamcenter Visualization V13.228
- Scalance Lpe9403 Firmware27
- Simatic Field Pg M527
- Simatic Ipc427e27
- Simatic Ipc477e27
- Simatic Ipc477e Pro27
- Simatic Ipc627e27
- Simatic Ipc677e27
- Simatic Itp100027
- Parasolid V33.126
- Ruggedcom Rox Mx5000 Firmware26
- Ruggedcom Rox Rx1400 Firmware26
- Ruggedcom Rox Rx1500 Firmware26
- Ruggedcom Rox Rx1501 Firmware26
- Ruggedcom Rox Rx1510 Firmware26
- Ruggedcom Rox Rx1511 Firmware26
- Ruggedcom Rox Rx1512 Firmware26
- Ruggedcom Rox Rx5000 Firmware26
- Simatic Field Pg M626
- Simatic Pcs 726
- Simatic Pcs Neo26
- Simatic S7-1500 Cpu 1511-1 Pn26
- Simatic S7-1500 Cpu 1511f-1 Pn26
- Simatic S7-1500 Cpu 1513-1 Pn26
- Simatic S7-1500 Cpu 1513f-1 Pn26
- Simatic S7-1500 Cpu 1515-2 Pn26
- Simatic S7-1500 Cpu 1515f-2 Pn26
- Simatic S7-1500 Cpu 1516-3 Pn/dp26
- Simatic S7-1500 Cpu 1516f-3 Pn/dp26
- Nucleus Net25
- Nucleus Source Code25
- Simatic Ipc127e25
- Simatic Ipc227g25
- Simatic Ipc277g25
- Simatic Ipc277g Pro25
- Simatic Ipc327g25
- Simatic Ipc377g25
- Simatic Pcs725
- Simatic Wincc V7.525
- Siplus Et 200sp Cpu 1512sp F-1 Pn25
- Siplus Ipc427e25
- Siplus S7-1500 Cpu 1511-1 Pn25
- Siplus S7-1500 Cpu 1511f-1 Pn25
- Siplus S7-1500 Cpu 1513-1 Pn25
- Siplus S7-1500 Cpu 1513f-1 Pn25
- Siplus S7-1500 Cpu 1516-3 Pn/dp25
- Siplus S7-1500 Cpu 1516f-3 Pn/dp25
- Scalance Lpe940324
- Scalance S615 Firmware24
- Sicam T24
- Simatic Drive Controller Cpu 1504d Tf24
- Simatic Drive Controller Cpu 1507d Tf24
- Simatic Ipc427e Firmware24
- Simatic Ipc477e Firmware24
- Simatic Itp1000 Firmware24
- Simatic S7-1500 Cpu 1511c-1 Pn24
- Simatic S7-1500 Cpu 1511t-1 Pn24
- Simatic S7-1500 Cpu 1511tf-1 Pn24
- Simatic S7-1500 Cpu 1512c-1 Pn24
- Simatic S7-1500 Cpu 1515t-2 Pn24
- Simatic S7-1500 Cpu 1515tf-2 Pn24
- Simatic S7-1500 Cpu 1516t-3 Pn/dp24
- Simatic S7-1500 Cpu 1516tf-3 Pn/dp24
- Simatic S7-1500 Cpu 1517-3 Pn/dp24
- Simatic S7-1500 Cpu 1517f-3 Pn/dp24
- Simatic S7-1500 Cpu 1517t-3 Pn/dp24
- Simatic S7-1500 Cpu 1517tf-3 Pn/dp24
- Simatic S7-1500 Cpu 1518-4 Pn/dp24
- Simatic S7-1500 Cpu 1518f-4 Pn/dp24
- Simatic S7-1500 Cpu 1518t-4 Pn/dp24
- Simatic S7-1500 Cpu 1518tf-4 Pn/dp24
- Siplus S7-1500 Cpu 1518-4 Pn/dp24
- Siplus S7-1500 Cpu 1518f-4 Pn/dp24
- Scalance W721-1 Rj4523
- Scalance W722-1 Rj4523
- Scalance W734-1 Rj4523
- Scalance W734-1 Rj45 (usa)23
- Scalance W738-1 M1223
- Scalance W748-1 M1223
- Scalance W748-1 Rj4523
- Scalance W761-1 Rj4523
- Scalance W774-1 M12 Eec23
- Scalance W774-1 Rj4523
- Scalance W774-1 Rj45 (usa)23
- Scalance W778-1 M1223
- Scalance W778-1 M12 Eec23
- Scalance W778-1 M12 Eec (usa)23
- Scalance W786-1 Rj4523
- Scalance W786-2ia Rj4523
Newest
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morecrypto: ccp: Don't attempt to copy CSR to userspace if PSP command failedCVE-2026-31699Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morecrypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failedCVE-2026-31698Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morecrypto: ccp: Don't attempt to copy ID to userspace if PSP command failedCVE-2026-31697Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: Fix missing validation of ticket length in non-XDR key preparsingCVE-2026-31696Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 more +3 morefuse: reject oversized dirents in page cacheCVE-2026-31694Public exploitFix available7.8 High
- gnu glibc, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 moreBuffer overread in ns_printrrf with corrupted RDATA fieldCVE-2026-6238Fix available6.5 Medium
- gnu glibc, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp, simatic s7-1500 cpu 1518f-4 pn/dp mfp +1 more +3 morePotential buffer overflow in ns_sprintrrf TSIG handling pathCVE-2026-5435Fix available7.3 High
- mit kerberos 5, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreIn MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application...CVE-2026-40355Fix available5.9 Medium
- andybalholm brotli, 7-zip p7zip, anthropic bun +100 more +102 moreOut-of-Bounds Write in Google Brotli DecoderCVE-2026-111497In KEVPublic exploitFix availableEPSS 82.6%9.2 Critical
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenetfilter: ip6t_eui64: reject invalid MAC header for all packetsCVE-2026-31685Fix available9.4 Critical
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morebridge: br_nd_send: linearize skb before parsing ND optionsCVE-2026-31682Fix available9.1 Critical
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 morenetfilter: xt_multiport: validate range encoding in checkentryCVE-2026-31681Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: ipv6: flowlabel: defer exclusive option free until RCU teardownCVE-2026-31680Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: only handle RESPONSE during service challengeCVE-2026-31676Fix available7.5 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()CVE-2026-31674Fix available7.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreaf_unix: read UNIX_DIAG_VFS data under unix_state_lockCVE-2026-31673Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morexfrm_user: fix info leak in build_report()CVE-2026-31671Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: rfkill: prevent unlimited numbers of rfkill events from being createdCVE-2026-31670Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moremptcp: fix slab-use-after-free in __inet_lookup_establishedCVE-2026-31669Fix available9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenetfilter: nft_ct: fix use-after-free in timeout object destroyCVE-2026-31665Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morexfrm: clear trailing padding in build_polexpire()CVE-2026-31664Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()CVE-2026-31658Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moremmc: vub300: fix NULL-deref on disconnectCVE-2026-31651Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: stmmac: fix integer underflow in chain modeCVE-2026-31649Fix available9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: Fix call removal to use RCU safe deletionCVE-2026-31642Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: reject undecryptable rxkad response ticketsCVE-2026-31637Fix available9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morerxrpc: fix reference count leak in rxrpc_server_keyring()CVE-2026-31634Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morerxrpc: proc: size address buffers for %pISpc outputCVE-2026-31630Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morenfc: llcp: add missing return after LLCP_CLOSED checksCVE-2026-31629Fix available8.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morex86/CPU: Fix FPDSS on Zen1CVE-2026-31628Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreHID: alps: fix NULL pointer dereference in alps_raw_event()CVE-2026-31625Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreHID: core: clamp report_size in s32ton() to avoid undefined shiftCVE-2026-31624Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreNFC: digital: Bounds check NFC-A cascade depth in SDD response handlerCVE-2026-31622Fix available8.8 High
- linux, linux kernel, red hat enterprise linux 10 +5 more +7 moreusb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb()CVE-2026-31617Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moresmb: client: fix OOB reads parsing symlink error responseCVE-2026-31613Fix available8.1 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreksmbd: validate EaNameLength in smb2_get_ea()CVE-2026-31612Fix available7.5 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moreksmbd: require 3 sub-authorities before reading sub_auth[2]CVE-2026-31611Fix available8.6 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremm: blk-cgroup: fix use-after-free in cgwb_release_workfn()CVE-2026-31586Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 moremedia: em28xx: fix use-after-free in em28xx_v4l2_open()CVE-2026-31583Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morebcache: fix cached_dev.sb_bio use-after-free and crashCVE-2026-31580Fix available7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreRDMA/irdma: Fix deadlock during netdev reset with active connectionsCVE-2026-31565Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: macb: Use dev_consume_skb_any() to free TX SKBsCVE-2026-31563Fix available7.5 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morefutex: Clear stale exiting pointer in futex_lock_pi() retry pathCVE-2026-31555Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet: bonding: fix NULL deref in bond_debug_rlb_hash_showCVE-2026-31546Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morenet/tls: fix use-after-free in -EBUSY error path of tls_do_encryptionCVE-2026-31533Fix available9.8 Critical
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morecan: raw: fix ro->uniq use-after-free in raw_rcv()CVE-2026-31532Fix available7.8 High
- gnupg libgcrypt, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0), simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ac0) +3 more +5 moreLibgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via...CVE-2026-41989Fix available6.7 Medium
- python, python software foundation cpython, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreBaseCookie.js_output() does not neutralize embedded charactersCVE-2026-6019Fix available2.1 Low
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moremodule: Fix kernel panic when a symbol st_shndx is out of boundsCVE-2026-31521Fix available5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 moreesp: fix skb leak with espintcp and async cryptoCVE-2026-31518Fix available5.5 Medium
- Show moreLoading…