By year
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Exploited Dassault Systèmes flaws
These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.
- CVE-2025-6205 Dassault Systèmes DELMIA Apriso Missing AuthorizationExploited since Oct 28, 2025 · CVSS 9.1
- CVE-2025-6204 Dassault Systèmes DELMIA Apriso Code InjectionExploited since Oct 28, 2025 · CVSS 8
- CVE-2025-5086 Dassault Systèmes DELMIA Apriso Deserialization of Untrusted DataExploited since Sep 11, 2025 · CVSS 9
Latest high and critical flaws
- CVE-2026-105412 An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to have read access the Tuleap database.High 7.1 · Oct 12, 2026
- CVE-2026-105411 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with trackeHigh 8.1 · Oct 12, 2026
- CVE-2026-105410 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary scriptHigh 8.7 · Oct 12, 2026
- CVE-2026-105409 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary scriptHigh 8.7 · Oct 12, 2026
- CVE-2026-105408 A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary scriptHigh 8.7 · Oct 12, 2026
- CVE-2026-105407 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary commands on the seHigh 8.8 · Oct 12, 2026
- CVE-2026-84154 A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attaCritical 9.9 · Sep 29, 2026
- CVE-2026-84285 An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the seHigh 8.8 · Sep 21, 2026
- CVE-2026-16279 An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attCritical 9.3 · Aug 27, 2026
- CVE-2026-19851 A Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to gain access to user accounts creatHigh 7.7 · Aug 25, 2026
- CVE-2026-17061 A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remCritical 10 · Aug 11, 2026
- CVE-2026-11756 A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPCritical 10 · Jul 28, 2026
- CVE-2026-14165 An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access dHigh 7.5 · Jul 13, 2026
- CVE-2026-9695 An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to theCritical 9.8 · Jul 8, 2026
- CVE-2026-5120 A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another userHigh 8.1 · Jul 1, 2026
- CVE-2026-10094 A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026 could allow an attackCritical 9.8 · Jun 17, 2026
- CVE-2026-9024 A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x througHigh 8.7 · Jun 1, 2026
- CVE-2026-7858 A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration StCritical 9.8 · Jun 1, 2026
- CVE-2025-10559 A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERHigh 7.1 · Mar 31, 2026
- CVE-2025-10553 A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x throHigh 8.7 · Mar 31, 2026
- CVE-2025-10551 A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x throHigh 8.7 · Mar 31, 2026
- CVE-2026-3476 A Code Injection vulnerability affecting SOLIDWORKS Desktop from Release 2025 through Release 2026 could allow an attacker to execute arbitrary code on the userHigh 7.8 · Mar 16, 2026
- CVE-2026-2101 A Reflected Cross-site Scripting (XSS) vulnerability affecting ENOVIAvpm Web Access from ENOVIAvpm Version 1 Release 16 through ENOVIAvpm Version 1 Release 19 aHigh 8.7 · Feb 16, 2026
- CVE-2026-1335 An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIHigh 7.8 · Feb 16, 2026
- CVE-2026-1334 An Out-Of-Bounds Read vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDHigh 7.8 · Feb 16, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.