polypyus

Polypyus Firmware Historian Polypyus learns to locate functions in raw binaries by extracting known functions from similar binaries. Thus, it is a firmware historian. Polypyus works without disassembling these binaries, which is an advantage for binaries that are complex to disassemble and where...

CVE-2026-115328

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2026-115328

The JSON-SCADA software, specifically versions before 0.65-alpha , is vulnerable to an SQL injection in the opcApi() function located at src/server_realtime_auth/index.js. This flaw allows authenticated users to inject stacked SQL statements via HistoryReadRequest parameters, such as NodeId.Id, S...

CVE-2026-115328 JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2026-115328 JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

EUVD-2026-108130

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

CVE-2026-115328 JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/serverrealtimeauth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modif...

PT-2026-121366

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi in src/server realtime auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read,...

CVE-2026-16438

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi...

CVE-2026-16437

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

CVE-2026-16438 An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi...

CVE-2026-16438 An arbitrary operation vulnerability in GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, and MC Works64

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi...

CVE-2026-16438

Mitsubishi Electric products including GENESIS64 , ICONICS Suite , Hyper Historian , AnalytiX , MobileHMI (versions 10.97.3 and prior), and MC Works64 (all versions) are vulnerable to an Incorrect Privilege Assignment (CWE-266). The root cause is that installers unnecessarily grant default DCOM p...

EUVD-2026-101942

Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, MC Works64 all versions, Mitsubishi...

CVE-2026-16437

Mitsubishi Electric products including GENESIS , GENESIS64 , ICONICS Suite , Hyper Historian , AnalytiX , MobileHMI , IoTWorX , MC Works64 , GENESIS32 , and BizViz are affected by a Weak Password Recovery Mechanism (CWE-640). An authenticated local user with administrative privileges can bypass a...

CVE-2026-16437 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

EUVD-2026-101941

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

CVE-2026-16437 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

CVE-2026-16436 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI...

CVE-2026-16436

Mitsubishi Electric products including GENESIS , GENESIS64 , ICONICS Suite , Hyper Historian , AnalytiX , MobileHMI , IoTWorX , MC Works64 , GENESIS32 , and BizViz are vulnerable to an authentication bypass due to a Weak Password Recovery Mechanism . Specifically, the challenge response used to u...