CVE Tools
Track your stack

Scadabr

11 CVEs tracked. 2 of them are in CISA KEV.

This hub aggregates every CVE we track for Scadabr, a product in the ics ot iot space. Use it to gauge the current risk picture and drill into individual advisories.

Scadabr CVEs per month

Nov 2024 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Scadabr CVEs per month
MonthCVEs
2024-110
2024-120
2025-010
2025-020
2025-030
2025-040
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-010
2026-020
2026-031
2026-040
2026-056
2026-060
2026-070
2026-080
2026-090
2026-100

Severity

How the 11 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical436%
  • High218%
  • Medium545%

Latest CVEs

The 11 most recently published vulnerabilities affecting Scadabr.

  1. CVE-2026-9646ScadaBR Unauthenticated Reflected Cross-Site Scripting6.1
  2. CVE-2026-9645ScadaBR Authenticated Remote Code Execution9.9
  3. CVE-2026-8605Use of Hard-coded Credentials in ScadaBR9.8
  4. CVE-2026-8604Cross-Site request forgery (CSRF) in ScadaBR8.8
  5. CVE-2026-8603Improper neutralization of special elements used in an OS command ('OS command injection') in ScadaBR9.8
  6. CVE-2026-8602Missing authentication for critical function in ScadaBR9.1
  7. CVE-2025-70973ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authen...4.8
  8. CVE-2021-26828OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows remote authenticated users to upload and execute arbitrary JSP files via view_edit.shtm.8.8
  9. CVE-2021-26829OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.5.4
  10. CVE-2019-16344A cross-site scripting (XSS) vulnerability in the login form (/ScadaBR/login.htm) in ScadaBR 1.0CE allows a remote attacker to inject arbitrary web script or HTML via the username or password param...6.1
  11. CVE-2019-16321ScadaBR 1.0CE, and 1.1.x through 1.1.0-RC, has XSS via a request for a nonexistent resource, as demonstrated by the dwr/test/ PATH_INFO.6.1

Product grouping is registry-driven, with AI assist and human review. How it works