Aggregating NVD, CVE, and multi-source threat feeds, this list provides deep analysis of high-risk threats such as RCE. By integrating CVSS and EPSS models, the system dynamically tracks Exp (Exploit) resources and PoC availability to accurately assess Exploitability. Combined with official Patches and remediation strategies, it helps prioritize Vulnerability Management workflows, significantly shortening response cycles and securing your critical assets.
Assigner (CNA / source)：[email protected] Remove this filter
| CVE | Description | Max CVSS | EPSS % | Published | Updated |
|---|---|---|---|---|---|
| CVE-2025-13957 | CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default. | 7.5 | 0.68% | 2026-03-10 | 2026-06-17 |
| CVE-2025-13902 | CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload. | 5.1 | 0.22% | 2026-03-10 | 2026-06-23 |
| CVE-2025-13901 | CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels. | 6.9 | 0.48% | 2026-03-10 | 2026-06-23 |
| CVE-2025-11739 | CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization. | 8.5 | 0.18% | 2026-03-10 | 2026-06-24 |
| CVE-2026-1227 | CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could cause unauthorized disclosure of local files, interaction within the EBO system, or denial of service conditions when a local user uploads a specially crafted TGML graphics file to the EBO server from Workstation. | 7.0 | 0.06% | 2026-02-11 | 2026-06-17 |
| CVE-2026-1226 | CWE‑94: Improper Control of Generation of Code vulnerability exists that could cause execution of untrusted or unintended code within the application when maliciously crafted design content is processed through a TGML graphics file. | 7.0 | 0.13% | 2026-02-11 | 2026-06-17 |
| CVE-2025-13905 | CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable service binaries are modified in the installation folder by a local user with normal privilege upon service restart. | 7.0 | 0.10% | 2026-01-29 | 2026-06-17 |
| CVE-2025-13845 | CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody. | 8.4 | 0.31% | 2026-01-15 | 2026-06-17 |
| CVE-2025-13844 | CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody. | 8.4 | 0.14% | 2026-01-15 | 2026-06-17 |
| CVE-2025-11567 | CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured. | 7.3 | 0.11% | 2025-11-12 | 2026-06-17 |
| CVE-2025-11566 | CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint. | 6.9 | 0.49% | 2025-11-12 | 2026-06-17 |
| CVE-2025-11565 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload. | 7.3 | 0.12% | 2025-11-12 | 2026-06-17 |
| CVE-2025-9997 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause command injection in BLMon that is executed in the operating system console when in a SSH session. | 5.8 | 0.50% | 2025-09-09 | 2026-06-17 |
| CVE-2025-9996 | CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause the execution of any shell command when executing a netstat command using BLMon Console in an SSH session. | 5.8 | 0.54% | 2025-09-09 | 2026-06-17 |
| CVE-2025-7746 | CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser. | 5.3 | 0.40% | 2025-09-09 | 2026-06-17 |
| CVE-2025-8449 | CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network. | 4.1 | 0.24% | 2025-08-20 | 2026-06-17 |
| CVE-2025-8448 | CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products. | 1.0 | 0.18% | 2025-08-20 | 2026-06-17 |
| CVE-2025-54927 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system. | 4.9 | 0.56% | 2025-08-20 | 2026-06-17 |
| CVE-2025-54926 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed. | 7.2 | 0.85% | 2025-08-20 | 2026-06-17 |
| CVE-2025-54925 | CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url. | 7.5 | 0.42% | 2025-08-20 | 2026-06-17 |