Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
24 results
Jul 7, 2026The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0CVE-2026-14868 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932High 8.4
The encryption algorithm used to protect the configuration of user accounts, stored in the built-in user directory of PcVue projects, all versions prior to 17.0.0, is not strong enough for the level of protection required. A local attacker could alter the existing configuration and ultimately gain privileged access to the PcVue application.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 7, 2026Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0.CVE-2026-14867 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 6.8
Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote atCVE-2026-1698 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 5.3
A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints /Authentication/ExternalLogin, /Authentication/AuthorizationCodeCallback and /Authentication/Logout of the WebClient and WebScheduler web apps.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.CVE-2026-1697 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 5.3
The Secure and SameSite attribute are missing in the GraphicalData web services and WebClient web app of PcVue in version 12.0.0 through 16.3.3 included.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Some HTTP security headers are not properly set by the web server when sending responses to the client application.CVE-2026-1696 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Low 2.3
Some HTTP security headers are not properly set by the web server when sending responses to the client application.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 inCVE-2026-1695 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 5.3
An XSS vulnerability affects the OAuth web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to trick a legitimate user into loading content from another site upon unsuccessful user authentication on an unknown application (unknown client_id). This vulnerability only affects the error page of the OAuth server.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScCVE-2026-1694 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Low 2.3
HTTP headers are added by the default configuration of IIS and ASP.net, and are not removed at the deployment phase of the webservices used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It unnecessarily exposes sensitive information about the server configuration.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue feCVE-2026-1693 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 5.3
The OAuth grant type Resource Owner Password Credentials (ROPC) flow is still used by the werbservices used by the WebVue, WebScheduler, TouchVue and Snapvue features of PcVue in version 12.0.0 through 16.3.3 included despite being deprecated. It might allow a remote attacker to steal user credentials.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features oCVE-2026-1692 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 5.3
A missing origin validation in WebSockets vulnerability affects the GraphicalData web services used by the WebVue, WebScheduler, TouchVue and SnapVue features of PcVue in version 12.0.0 through 16.3.3 included. It might allow a remote attacker to lure a successfully authenticated user to a malicious website. This vulnerability only affects the following two endpoints: GraphicalData/js/signalR/connect and GraphicalData/js/signalR/reconnect.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacCVE-2025-9999 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932High 7.6
Some payload elements of the messages sent between two stations in a networking architecture are not properly checked on the receiving station allowing an attacker to execute unauthorized commands in the application.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 5, 2025The sequence of packets received by a Networking server are not correctly checked.CVE-2025-9998 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 6
The sequence of packets received by a Networking server are not correctly checked. An attacker could exploit this vulnerability to send specially crafted messages to force the application to stop.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 6, 2025The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid.CVE-2025-4384 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Medium 6
The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices to present certificates that are not rejected properly. The use of a client certificate reduces the risk for random devices to take advantage of this flaw.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 9, 2024User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with thCVE-2024-12057 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Low 1.8
User credentials (login & password) are inserted into log files when a user tries to authenticate using a version of a Web client that is not compatible with that of the PcVue Web back end. By exploiting this vulnerability, an attacker could retrieve the credentials of a user by accessing the Log File. Successful exploitation of this vulnerability could lead to unauthorized access to the application.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 4, 2024The Client secret is not checked when using the OAuth Password grant type.CVE-2024-12056 · Other software · arcinfo · reported by 87c8e6ad-f0f5-4ca8-89e2-89f26d6ed932Low 2.3
The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022 A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3.CVE-2022-4312 · Other software · ARC Informatique · reported by ics-cert@hq.dhs.govMedium 5.5
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email account and SIM card.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.compcvuesolutions.com
Dec 12, 2022 An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2.CVE-2022-4311 · Other software · ARC Informatique · reported by ics-cert@hq.dhs.govMedium 4.7
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.compcvuesolutions.com
Aug 24, 2022The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belongiCVE-2022-2569 · Other software · ARC Informatique · reported by ics-cert@hq.dhs.govMedium 5.5
The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belonging to legitimate users
- Product
- PcVue 12 OAuth web service configuration
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 12, 2020ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users.CVE-2020-26869 · Other software · ARC Informatique · reported by vulnerability@kaspersky.comHigh 7.5
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to information exposure, allowing unauthorized users to access session data of legitimate users. This issue also affects third-party systems based on the Web Services Toolkit.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comus-cert.cisa.gov
Oct 12, 2020ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information useCVE-2020-26868 · Other software · ARC Informatique · reported by vulnerability@kaspersky.comHigh 7.5
ARC Informatique PcVue prior to version 12.0.17 is vulnerable to a denial-of-service attack due to the ability of an unauthorized user to modify information used to validate messages sent by legitimate web clients. This issue also affects third-party systems based on the Web Services Toolkit.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comus-cert.cisa.gov
Oct 12, 2020ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbiCVE-2020-26867 · Other software · ARC Informatique · reported by vulnerability@kaspersky.comCritical 9.8
ARC Informatique PcVue prior to version 12.0.17 is vulnerable due to the deserialization of untrusted data, which may allow an attacker to remotely execute arbitrary code on the web and mobile back-end server.
- Product
- PcVue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordics-cert.kaspersky.comus-cert.cisa.gov
Apr 2, 2012Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cCVE-2011-4045 · Other software · Arcinfo · reported by cret@cert.orgMedium 4.3
Buffer overflow in an unspecified ActiveX control in aipgctl.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to cause a denial of service via a crafted HTML document.
- Product
- Frontvue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.comus-cert.gov
Apr 2, 2012An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calCVE-2011-4044 · Other software · Arcinfo · reported by cret@cert.orgMedium 5.8
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.
- Product
- Frontvue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.comus-cert.gov
Apr 2, 2012Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to CVE-2011-4043 · Other software · Arcinfo · reported by cret@cert.orgHigh 9.3
Integer overflow in an unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code via a large value for an integer parameter, leading to a buffer overflow.
- Product
- Frontvue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.comus-cert.gov
Apr 2, 2012An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary coCVE-2011-4042 · Other software · Arcinfo · reported by cret@cert.orgHigh 9.3
An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to execute arbitrary code by using a crafted HTML document to obtain control of a function pointer.
- Product
- Frontvue
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpcvuesolutions.comus-cert.gov
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.