Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
31 results
Jul 6, 2026Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL.CVE-2026-6901 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comHigh 8.4
Untrusted Search Path vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-cws-assets.de-fra-1.linodeobjects.com
Jul 6, 2026Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL.CVE-2026-6900 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comCritical 9.1
Improper certificate validation vulnerability in B&R Industrial Automation GmbH APROL. This issue affects APROL: before R 4.4-01P5.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-cws-assets.de-fra-1.linodeobjects.com
Mar 25, 2025An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to CVE-2024-10210 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comHigh 8.4
An External Control of File Name or Path vulnerability in the APROL Web Portal used in B&R APROL <4.4-005P may allow an authenticated network-based attacker to access data from the file system.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker toCVE-2024-8315 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comMedium 6.8
An Improper Handling of Insufficient Permissions or Privileges vulnerability in scripts used in B&R APROL <4.4-00P5 may allow an authenticated local attacker to read credential information.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL <CVE-2024-8314 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comMedium 5.5
An Incorrect Implementation of Authentication Algorithm and Exposure of Data Element to Wrong Ses-sion vulnerability in the session handling used in B&R APROL <4.4-00P5 may allow an authenticated network attacker to take over a currently active user session without login credentials.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMCVE-2024-8313 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comHigh 8.7
An Exposure of Sensitive System Information to an Unauthorized Control Sphere and Initialization of a Resource with an Insecure Default vulnerability in the SNMP component of B&R APROL <4.4-00P5 may allow an unauthenticated adjacent-based attacker to read and alter configuration using SNMP.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unaCVE-2024-45484 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comHigh 7.2
An Allocation of Resources Without Limits or Throttling vulnerability in the operating system network configuration used in B&R APROL <4.4-00P5 may allow an unauthenticated adjacent attacker to per-form Denial-of-Service (DoS) attacks against the product.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to CVE-2024-45483 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comHigh 7
A Missing Authentication for Critical Function vulnerability in the GRUB configuration used B&R APROL <4.4-01 may allow an unauthenticated physical attacker to alter the boot configuration of the operating system.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker froCVE-2024-45482 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 8.5
An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL <4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to auCVE-2024-45481 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 8.5
An Incomplete Filtering of Special Elements vulnerability in scripts using the SSH server on B&R APROL <4.4-00P5 may allow an authenticated local attacker to authenticate as another legitimate user.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticateCVE-2024-45480 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comCritical 9.2
An improper control of generation of code ('Code Injection') vulnerability in the AprolCreateReport component of B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to read files from the local system.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker toCVE-2024-10209 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comHigh 8.5
An Incorrect Permission Assignment for Critical Resource vulnerability in the file system used in B&R APROL <4.4-01 may allow an authenticated local attacker to read and alter the configuration of another engineering or runtime user.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated netwCVE-2024-10208 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comMedium 5.1
An Improper Neutralization of Input During Web Page Generation vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to insert malicious code which is then executed in the context of the user’s browser session.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the wCVE-2024-10207 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comMedium 5.3
A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an authenticated network-based attacker to force the web server to request arbitrary URLs.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 25, 2025A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force theCVE-2024-10206 · Other software · B&R Industrial Automation GmbH · reported by cybersecurity@ch.abb.comMedium 6.9
A Server-Side Request Forgery vulnerability in the APROL Web Portal used in B&R APROL <4.4-00P5 may allow an unauthenticated network-based attacker to force the web server to request arbitrary URLs.
- Product
- APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL <= R 4.4-00P3 may allow a network-based attacker to execute arbitrary JavaScript CVE-2024-5624 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comMedium 5.1
Reflected Cross-Site Scripting (XSS) in Shift Logbook application of B&R APROL <= R 4.4-00P3 may allow a network-based attacker to execute arbitrary JavaScript code in the context of the user's browser session
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code unCVE-2024-5623 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comMedium 5.4
An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 29, 2024An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker tCVE-2024-5622 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 7.3
An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 8, 2023B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to caCVE-2022-43765 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 7.5
B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Feb 8, 2023Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow.CVE-2022-43764 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comCritical 9.8
Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow. This may lead to Denial-of-Service conditions or execution of arbitrary code.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Feb 8, 2023Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.CVE-2022-43763 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 7.5
Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Feb 8, 2023 Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages CVE-2022-43762 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comHigh 7.5
Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Feb 8, 2023Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration.CVE-2022-43761 · Other software · B&R Industrial Automation · reported by cybersecurity@ch.abb.comCritical 9.4
Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration.
- Product
- B&R APROL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Nov 27, 2020An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.CVE-2019-19878 · Other software · Br-automation · reported by MITREHigh 7.5
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to historical data from AprolSqlServer by bypassing authentication, a different vulnerability than CVE-2019-16358.
- Product
- Industrial Automation Aprol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Nov 27, 2020An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.CVE-2019-19877 · Other software · Br-automation · reported by MITREMedium 5.3
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get access to sensitive information outside the working directory via Directory Traversal attacks against AprolSqlServer, a different vulnerability than CVE-2019-16357.
- Product
- Industrial Automation Aprol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Nov 27, 2020An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.CVE-2019-19876 · Other software · Br-automation · reported by MITRECritical 9.8
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An EnMon PHP script was vulnerable to SQL injection, a different vulnerability than CVE-2019-10006.
- Product
- Industrial Automation Aprol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Nov 27, 2020An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.CVE-2019-19875 · Other software · Br-automation · reported by MITRECritical 9.8
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected (using Python scripts) via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364.
- Product
- Industrial Automation Aprol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Nov 27, 2020An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.CVE-2019-19874 · Other software · Br-automation · reported by MITRECritical 9.8
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Some web scripts in the web interface allowed injection and execution of arbitrary unintended commands on the web server, a different vulnerability than CVE-2019-16364.
- Product
- Industrial Automation Aprol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Nov 27, 2020An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.CVE-2019-19873 · Other software · Br-automation · reported by MITREHigh 7.5
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. An attacker can get information from the AprolSqlServer DBMS by bypassing authentication, a different vulnerability than CVE-2019-16356 and CVE-2019-9983.
- Product
- Industrial Automation Aprol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Nov 27, 2020An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.CVE-2019-19872 · Other software · Br-automation · reported by MITRECritical 9.8
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject and execute arbitrary unintended commands via an unspecified attack scenario, a different vulnerability than CVE-2019-16364.
- Product
- Industrial Automation Aprol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Nov 27, 2020An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08.CVE-2019-19869 · Other software · Br-automation · reported by MITREHigh 7.5
An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. PVs could be changed (unencrypted) by using the IosHttp service and the JSON interface.
- Product
- Industrial Automation Aprol
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbr-automation.combr-automation.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.