Updated 8 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

526new WordPress flaws this week

391,181entries in the database

1,389 results · page 3 of 28

Feb 9, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66596 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Medium 6.9
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate request headers. When an attacker inserts an invalid host header, users could be redirected to malicious sites. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 9, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66595 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Medium 6.3
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product is vulnerable to Cross-Site Request Forgery (CSRF). When a user accesses a link crafted by an attacker, the user’s account could be compromised. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 9, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66594 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Medium 6.9
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Detailed messages are displayed on the error page. This information could be exploited by an attacker for other attacks. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66608 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9High 8.7
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send specially crafted requests to steal files from the web server. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66607 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Medium 6.3
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains an insecure setting. Users could be redirected to malicious sites by an attacker. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66606 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Low 2.1
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly encode URLs. An attacker could tamper with web pages or execute malicious scripts. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66605 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Low 2.1
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields on this webpage with the autocomplete attribute enabled, the input content could be saved in the browser the user is using. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66604 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Low 2.1
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The library version could be displayed on the web page. This information could be exploited by an attacker for other attacks. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66603 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Low 2.1
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attacker could potentially use this information to carry out other attacks. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66602 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Medium 6.9
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts access by IP address. When a worm that randomly searches for IP addresses intrudes into the network, it could potentially be attacked by the worm. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66601 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Medium 6.3
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not specify MIME types. When an attacker performs a content sniffing attack, malicious scripts could be executed. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66600 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9High 8.8
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product lacks HSTS (HTTP Strict Transport Security) configuration. When an attacker performs a Man in the middle (MITM) attack, communications with the web server could be sniffed. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 8, 2026A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.CVE-2025-66599 · Other software · Yokogawa Electric Corporation · reported by 7168b535-132a-4efe-a076-338f829b2eb9Medium 6.9
A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Physical paths could be displayed on web pages. This information could be exploited by an attacker for other attacks. The affected products and versions are as follows: FAST/TOOLS (Packages: RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB) R9.01 to R10.04
Product
FAST/TOOLS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record web-material3.yokogawa.com
Feb 5, 2026Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unaCVE-2025-15080 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 8.8
Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an unauthenticated attacker to read device data or part of a control program from the affected product, write device data in the affected product, or cause a denial of service (DoS) condition on the affected product by sending a specially crafted packet containing a specific command to the affected product.
Product
MELSEC iQ-R Series R08PCPU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp cisa.gov
Feb 4, 2026Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execCVE-2025-10314 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 8.8
Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to execute arbitrary code with system privileges by replacing service executable files (EXE) or DLLs in the installation directory with specially crafted files. As a result, the attacker may be able to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a Denial of Service (DoS) condition on the affected system.
Product
FREQSHIP-mini for Windows
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp cisa.gov
Jan 29, 2026CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable servicCVE-2025-13905 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7
CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable service binaries are modified in the installation folder by a local user with normal privilege upon service restart.
Product
EcoStruxure™ Process Expert
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Jan 22, 2026Electrician - Electrical Service: Server-Side Request Forgery (SSRF)CVE-2026-22358 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician allows Server Side Request Forgery.This issue affects Electrician - Electrical Service WordPress: from n/a through <= 5.6.
Product
Electrician - Electrical Service
Affected
up to 5.6
What to do
Affects up to 5.6. Update Electrician - Electrical Service to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jan 15, 2026CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody.CVE-2025-13845 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.4
CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody.
Product
EcoStruxure Power Build Rapsody
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Jan 15, 2026CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the atCVE-2025-13844 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 8.4
CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.
Product
EcoStruxure Power Build Rapsody
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Jan 14, 2026Electric Studio Download Counter: Stored Cross-Site ScriptingCVE-2026-0741 · WordPress plugins & themes · reported by WordfenceMedium 4.4
The Electric Studio Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin settings in all versions up to, and including, 2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Electric Studio Download Counter
Affected
up to 2.4
What to do
Affects up to 2.4. Update Electric Studio Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jan 5, 2026WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections.CVE-2025-14346 · Other software · WHILL · reported by ics-cert@hq.dhs.govCritical 9.3
WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user interaction.
Product
Model C2 Electric Wheelchair
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Dec 24, 2025A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.CVE-2025-3232 · Other software · Mitsubishi Electric Europe · reported by ics-cert@hq.dhs.govHigh 8.7
A remote unauthenticated attacker may be able to bypass authentication by utilizing a specific API route to execute arbitrary OS commands.
Product
smartRTU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record emea.mitsubishielectric.com github.com
Dec 18, 2025Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referredCVE-2025-11774 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 8.2
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the software keyboard function (hereinafter referred to as "keypad function") of Mitsubishi Electric GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97.2 CFR3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions ICONICS Suite versions 10.97.2 CFR3 and prior, Mitsubishi Electric MobileHMI versions 10.97.2 CFR3 and prior, Mitsubishi Electric Iconics Digital Solutions MobileHMI versions 10.97.2 CFR3 and prior, and Mitsubishi Electric MC Works64 all versions allows a local attacker to execute arbitrary executable files (EXE) when a legitimate user uses the keypad function by tampering with the configuration file for the function. This could allow the attacker to disclose, tamper with, delete, or destroy information stored on the PC where the affected product is installed, or cause a denial-of-service (DoS) condition on the system, through the execution of the EXE.
Product
GENESIS64
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Dec 16, 2025Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GT Designer3 Version1 (GOT2000) all versions and Mitsubishi Electric GT DesignerCVE-2025-11009 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.1
Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GT Designer3 Version1 (GOT2000) all versions and Mitsubishi Electric GT Designer3 Version1 (GOT1000) all versions allows a local unauthenticated attacker to obtain plaintext credentials from the project file for GT Designer3. This could allow the attacker to operate illegally GOT2000 series or GOT1000 series by using the obtained credentials.
Product
GT Designer3 Version1 (GOT2000)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Dec 16, 2025Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-bounds write while processing a specially crafted project file, which may allow an attacker to execCVE-2025-53524 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 8.4
Fuji Electric Monitouch V-SFT-6 is vulnerable to an out-of-bounds write while processing a specially crafted project file, which may allow an attacker to execute arbitrary code.
Product
Monitouch V-SFT-6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record felib.fujielectric.co.jp github.com
Nov 27, 2025Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext froCVE-2025-3784 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.5
Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext from project files. As a result, the attacker may be able to open project files protected by user authentication using disclosed credential information, and obtain or modify project information.
Product
GX Works2
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp cisa.gov
Nov 18, 2025Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO.CVE-2025-10089 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.7
Uncontrolled Search Path Element Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S Setting Application all versions, MILCO.S Setting Application (IR) all versions, MILCO.S Easy Setting Application (IR) all versions, and MILCO.S Easy Switch Application (IR) all versions allows a local attacker to execute malicious code by having installer to load a malicious DLL. However, if the signer name "Mitsubishi Electric Lighting" appears on the "Digital Signatures" tab of the properties for "MILCO.S Lighting Control.exe", the application is a fixed one. This vulnerability only affects when the installer is run, not after installation. If a user downloads directly from Mitsubishi Electric website and installs the affected product, there is no risk of malicious code being introduced.
Product
MILCO.S Setting Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp mitsubishielectric.com
Nov 12, 2025CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured.CVE-2025-11567 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.3
CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured.
Product
PowerChute™ Serial Shutdown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Nov 12, 2025CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the CVE-2025-11566 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 6.9
CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint.
Product
PowerChute™ Serial Shutdown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Nov 12, 2025CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web ACVE-2025-11565 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.3
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.
Product
PowerChute™ Serial Shutdown
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Nov 6, 2025Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module CVE-2025-10259 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote attacker to disconnect the connection by sending specially crafted TCP packets to cause a denial-of-service (DoS) condition on the products. There is no impact on connections other than the attacked one.
Product
MELSEC iQ-F Series FX5U-32MT/ES
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp cisa.gov
Nov 4, 2025Fuji Electric Monitouch V-SFT-6 is vulnerable to a stack-based buffer overflow while processing a specially crafted project file, which may allow an attacker CVE-2025-54526 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 8.4
Fuji Electric Monitouch V-SFT-6 is vulnerable to a stack-based buffer overflow while processing a specially crafted project file, which may allow an attacker to execute arbitrary code.
Product
Monitouch V-SFT-6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record felib.fujielectric.co.jp github.com
Nov 4, 2025A maliciously crafted project file may cause a heap-based buffer overflow in Fuji Electric Monitouch V-SFT-6, which may allow the attacker to execute arbitrarCVE-2025-54496 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 8.4
A maliciously crafted project file may cause a heap-based buffer overflow in Fuji Electric Monitouch V-SFT-6, which may allow the attacker to execute arbitrary code.
Product
Monitouch V-SFT-6
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record felib.fujielectric.co.jp github.com
Oct 10, 2025A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier.CVE-2025-61864 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
A use after free vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Oct 10, 2025An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete_mem of V-SFT v6.2.7.0 and earlier.CVE-2025-61863 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::delete_mem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Oct 10, 2025An out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0 and earlier.CVE-2025-61862 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds read vulnerability exists in VS6ComFile!get_ovlp_element_size of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Oct 10, 2025An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier.CVE-2025-61861 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds read vulnerability exists in VS6ComFile!load_link_inf of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Oct 10, 2025An out-of-bounds read vulnerability exists in VS6MemInIF!set_temp_type_default of V-SFT v6.2.7.0 and earlier.CVE-2025-61860 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds read vulnerability exists in VS6MemInIF!set_temp_type_default of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Oct 10, 2025An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::is_motion_tween of V-SFT v6.2.7.0 and earlier.CVE-2025-61859 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds write vulnerability exists in VS6ComFile!CItemDraw::is_motion_tween of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Oct 10, 2025An out-of-bounds write vulnerability exists in VS6ComFile!set_AnimationItem of V-SFT v6.2.7.0 and earlier.CVE-2025-61858 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds write vulnerability exists in VS6ComFile!set_AnimationItem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Oct 10, 2025An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlier.CVE-2025-61857 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
An out-of-bounds write vulnerability exists in VS6ComFile!CItemExChange::WinFontDynStrCheck of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Oct 10, 2025A stack-based buffer overflow vulnerability exists in VS6ComFile!CV7BaseMap::WriteV7DataToRom of V-SFT v6.2.7.0 and earlier.CVE-2025-61856 · Other software · FUJI ELECTRIC CO., LTD. / Hakko Electronics Co., Ltd. · reported by vultures@jpcert.or.jpHigh 8.4
A stack-based buffer overflow vulnerability exists in VS6ComFile!CV7BaseMap::WriteV7DataToRom of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end (ABEND), and arbitrary code execution.
Product
V-SFT
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp monitouch.fujielectric.com
Sep 28, 2025A vulnerability was detected in CodeAstro Electricity Billing System 1.0.CVE-2025-11104 · Other software · CodeAstro · reported by VulDBLow 2.1
A vulnerability was detected in CodeAstro Electricity Billing System 1.0. Affected by this issue is some unknown functionality of the file /admin/bill.php. The manipulation of the argument uid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Product
Electricity Billing System
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record codeastro.com github.com
Sep 25, 2025Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc.CVE-2025-10438 · Other software · Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. · reported by iletisim@usom.gov.trHigh 8.6
Path Traversal: 'dir/../../filename' vulnerability in Yordam Information Technology Consulting Education and Electrical Systems Industry Trade Inc. Yordam Katalog allows Path Traversal. This issue affects Yordam Katalog: before 21.7.
Product
Yordam Katalog
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
Sep 19, 2025Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU,CVE-2025-8531 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 6.8
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled.
Product
MELSEC-Q Series Q03UDVCPU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp cisa.gov
Sep 9, 2025CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in BLCVE-2025-9997 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.8
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in BLMon that is executed in the operating system console when in a SSH session.
Product
Saitel DR RTU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Sep 9, 2025CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any shCVE-2025-9996 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.8
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any shell command when executing a netstat command using BLMon Console in an SSH session.
Product
Saitel DR RTU
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com
Sep 9, 2025CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected CVE-2025-7746 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.3
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.
Product
ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record download.schneider-electric.com seclists.org
Sep 3, 2025Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attackerCVE-2025-9365 · Other software · Fuji Electric · reported by ics-cert@hq.dhs.govHigh 8.4
Fuji Electric FRENIC-Loader 4 is vulnerable to a deserialization of untrusted data when importing a file through a specified window, which may allow an attacker to execute arbitrary code.
Product
FRENIC-Loader 4
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record felib.fujielectric.co.jp cisa.gov
Sep 1, 2025Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated aCVE-2025-7731 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.5
Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or write the device values of the product and stop the operations of programs by using the obtained credential information.
Product
MELSEC iQ-F Series FX5U-32MT/ES
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record jvn.jp cisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.