Vega vulnerabilities

Products

• Vega 10

Newest

• vega vegapuls 6x firmware, vega grieshaber vegapuls 6x two-wire profinet, modbus tcp, opc ua (ethernet-apl) +1 more VEGA: Privilege escalation through unsecured configuration interface in VEGAPULS devices CVE-2026-3323 7.5 HighApril 28, 2026
• vega, vega-functions project vega-functions +1 more `vega-functions` vulnerable to Cross-site Scripting via `setdata` function CVE-2025-66648 Fix available 7.2 HighJanuary 5, 2026
• vega Vega Cross-Site Scripting (XSS) via expression abusing vlSelectionTuples function array map calls in environments with satisfactory function gadgets in the global scope CVE-2025-65110 Fix available 8.1 HighJanuary 5, 2026
• vega Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable CVE-2025-59840 Fix available 8.1 HighNovember 13, 2025
• vega Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace] CVE-2025-27793 Fix available 5.3 MediumMarch 27, 2025
• vega, vega-functions project vega-functions +1 more Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode `expressionInterpeter` CVE-2025-26619 Fix available 5.3 MediumMarch 27, 2025
• vega Vega allows Cross-site Scripting via the vlSelectionTuples function CVE-2025-25304 Fix available 6.9 MediumFebruary 14, 2025
• gobalsky vega, vega-functions project vega-functions +1 more Vega's validators able to submit duplicate transactions CVE-2023-35163 Fix available 6.0 MediumJune 20, 2023
• vega, vega-functions project vega-functions +1 more Vega `scale` expression function cross site scripting CVE-2023-26486 Fix available 6.5 MediumMarch 2, 2023
• vega, vega-functions project vega-functions +1 more Vega has cross-site scripting vulnerability in `lassoAppend` function CVE-2023-26487 Fix available 6.5 MediumMarch 2, 2023
• vega XSS in Vega CVE-2020-26296 Fix available 8.7 HighDecember 30, 2020