Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Nov 6, 2025Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module CVE-2025-10259 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.3
Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote attacker to disconnect the connection by sending specially crafted TCP packets to cause a denial-of-service (DoS) condition on the products. There is no impact on connections other than the attacked one.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated aCVE-2025-7731 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.5
Cleartext Transmission of Sensitive Information vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to obtain credential information by intercepting SLMP communication messages, and read or write the device values of the product and stop the operations of programs by using the obtained credential information.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 1, 2025Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attaCVE-2025-7405 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.3
Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to read or write the device values of the product and stop the operation of the programs, since MODBUS/TCP in the products does not have authentication features.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 25, 2025Improper Handling of Length Parameter Inconsistency vulnerability in web server function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allowsCVE-2025-5514 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.3
Improper Handling of Length Parameter Inconsistency vulnerability in web server function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthenticated attacker to delay the processing of the web server function and prevent legitimate users from utilizing the web server function, by sending a specially crafted HTTP request.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 10, 2025Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to locCVE-2025-5241 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.3
Overly Restrictive Account Lockout Mechanism vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series allows a remote unauthenticated attacker to lockout legitimate users for a certain period by repeatedly attempting to login with incorrect passwords. The legitimate users will be unable to login until a certain period has passed after the lockout or until the product is reset.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcisa.govmitsubishielectric.com
May 29, 2025Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a reCVE-2025-3755 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 9.1
Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules allows a remote unauthenticated attacker to read information in the product, to cause a Denial-of-Service (DoS) condition in MELSOFT connection, or to stop the operation of the CPU module (causing a DoS condtion on the CPU module), by sending specially crafted packets. The product is needed to reset for recovery.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 6, 2023Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server functiCVE-2023-4625 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.3
Improper Restriction of Excessive Authentication Attempts vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F/iQ-R Series CPU modules Web server function allows a remote unauthenticated attacker to prevent legitimate users from logging into the Web server function for a certain period after the attacker has attempted to log in illegally by continuously attempting unauthorized login to the Web server function. The impact of this vulnerability will persist while the attacker continues to attempt unauthorized login.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 24, 2023Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSECVE-2023-1424 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpCritical 10
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series CPU modules and MELSEC iQ-R Series CPU modules allows a remote unauthenticated attacker to cause a denial of service (DoS) condition or execute malicious code on a target product by sending specially crafted packets. A system reset of the product is required for recovery from a denial of service (DoS) condition and malicious code execution.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 3, 2023Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allCVE-2023-0457 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpHigh 7.5
Plaintext Storage of a Password vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series, MELSEC iQ-R Series, MELSEC-Q Series and MELSEC-L Series allows a remote unauthenticated attacker to disclose plaintext credentials stored in project files and login into FTP server or Web server.
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 20, 2023Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ECVE-2022-40267 · Other software · Mitsubishi Electric Corporation · reported by Mitsubishielectric.Psirt@yd.MitsubishiElectric.co.jpMedium 5.9
Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=ES,DS,ESS,DSS) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 17X**** or later, and versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-xMy/z (x=32,64,96, y=T, z=D,DSS)) with serial number 179**** and prior, and versions 1.074 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UC-32MT/DSS-TS versions 1.280 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/z (x=24,40,60, y=T,R, z=ES,ESS) versions 1.042 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5UJ-xMy/ES-A (x=24,40,60, y=T,R) versions 1.043 and prior, Mitsubishi Electric Corporation MELSEC iQ-F Series FX5S
- Product
- MELSEC iQ-F Series FX5U-32MT/ES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.