Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 81

Export CSV
CVE-2026-81823

AVEVA Pipeline Integrity Monitor Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Pipeline Integrity Monitor
CVE-2026-81824

AVEVA Pipeline Integrity Monitor cross-site scripting

The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered to click on a malicious link.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Pipeline Integrity Monitor
CVE-2026-81822

AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algorithm

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords through computational brute-forcing of weak hashes, potentially allowing elevation to a PIMBoards administrator user.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Pipeline Integrity Monitor
CVE-2026-81821

AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key

The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Pipeline Integrity Monitor
CVE-2025-7639

AVEVA Enterprise SCADA Deserialization of Untrusted Data

The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Aveva Enterprise Scada Aveva Enterprise Scada Hmi Aveva Pipeline Integrity Monitor (delivered On Pipeline Simulation Media) and 3 more
CVE-2026-1495

Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent

The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including URL and proxy credentials, from the PI to CONNECT event log files. This could enable unauthorized access to the proxy server.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Pi To Connect Agent
CVE-2026-1507

Uncaught Exception vulnerability in AVEVA PI Data Archive

The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Pi Data Archive Pi Server
CVE-2026-5387

AVEVA Pipeline Simulation Missing Authorization

The vulnerability, if exploited, could allow an unauthenticated miscreant to perform operations intended only for Simulator Instructor or Simulator Developer (Administrator) roles, resulting in privilege escalation with potential for modification of simulation parameters, training configuration, and training records.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Pipeline Simulation 2025
CVE-2025-9317

AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm

The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Edge
CVE-2024-6456

SQL Injection vulnerability in AVEVA Historian Server

AVEVA Historian Server has a vulnerability, if exploited, could allow a malicious SQL command to execute under the privileges of an interactive Historian REST Interface user who had been socially engineered by a miscreant into opening a specially crafted URL.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Historian
CVE-2024-6619

Incorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream Report

In Ocean Data Systems Dream Report, an incorrect permission vulnerability could allow a local unprivileged attacker to escalate their privileges and could cause a denial-of-service.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Aveva Ocean Data Systems
Products
Reports For Operations 2023 Dream Report 2023
CVE-2025-8386

AVEVA Application Server IDE Basic Cross-site Scripting

The vulnerability, if exploited, could allow an authenticated miscreant (with privilege of "aaConfigTools") to tamper with App Objects' help files and persist a cross-site scripting (XSS) injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The vulnerability can only be exploited during config-time operations within the IDE component of Application Server. Run-time components and operations are not affected.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Application Server
CVE-2025-61937

AVEVA Process Optimization Code Injection

The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the  model application server.

CVSS 4.0 · 10 Critical EPSS 1.5% KEV · Not listed
Vendors
Aveva
Products
Process Optimization
CVE-2025-61943

AVEVA Process Optimization SQL Injection

The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative privileges, potentially resulting in complete compromise of the SQL Server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Historian Process Optimization
CVE-2025-64691

AVEVA Process Optimization Code Injection

The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete compromise of the model application server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Process Optimization
CVE-2025-64729

AVEVA Process Optimization Missing Authorization

The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privileges to the identity of a victim user who subsequently interacts with the project files.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Process Optimization
CVE-2025-65117

AVEVA Process Optimization Use of Potentially Dangerous Function

The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a victim user who subsequently interacts with the graphical elements.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Process Optimization
CVE-2025-65118

AVEVA Process Optimization Uncontrolled Search Path Element

The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially resulting in complete compromise of the Model Application Server.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Application Server Process Optimization
CVE-2025-64769

AVEVA Process Optimization Cleartext Transmission of Sensitive Information

The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or data leakage in certain man-in-the-middle or passive inspection scenarios.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Aveva
Products
Process Optimization