PT
Vendor
Ptc
96
CVEs
3
On KEV
0
New 30D
Products
FL9.8
FlexPLM
PTC
4 CVEs1 on KEV0 new
WP9.8
Windchill PDMLink
PTC
4 CVEs1 on KEV0 new
WA9.8
Windchill and FlexPLM
PTC
1 CVEs1 on KEV0 new
TI9.8
Thingworx Industrial Connectivity
Ptc
13 CVEs0 on KEV0 new
TK9.8
Thingworx Kepware Server
Ptc
11 CVEs0 on KEV0 new
KK9.8
Kepware Kepserverex
Ptc
9 CVEs0 on KEV0 new
AA9.8
Axeda Agent
Ptc
7 CVEs0 on KEV0 new
AD9.8
Axeda Desktop Server
Ptc
7 CVEs0 on KEV0 new
OP9.8
Opc-aggregator
Ptc
7 CVEs0 on KEV0 new
TK9.8
Thingworx Kepware Edge
Ptc
6 CVEs0 on KEV0 new
VS9.9
Vuforia Studio
Ptc
6 CVEs0 on KEV0 new
TP7.5
Thingworx Platform
Ptc
4 CVEs0 on KEV0 new
KE9.1
Keepserverex
Ptc
2 CVEs0 on KEV0 new
KS9.8
Kepware Server
Ptc
2 CVEs0 on KEV0 new
KS9.8
Kepware Serverex
Ptc
2 CVEs0 on KEV0 new
TE9.8
Thingworx Edge C-sdk
Ptc
2 CVEs0 on KEV0 new
TE9.8
Thingworx Edge Microserver
Ptc
2 CVEs0 on KEV0 new
TN9.8
Thingworx .net-sdk
Ptc
2 CVEs0 on KEV0 new
CV–
Creo View
Ptc
1 CVEs0 on KEV0 new
IS–
Isoview
Ptc
1 CVEs0 on KEV0 new
MA–
Mathcad
Ptc
1 CVEs0 on KEV0 new
TH6.5
Thingworx
Ptc
1 CVEs0 on KEV0 new
WR9.3
Windchill Risk and Reliability Enterprise Edition (Formerly Relex)
PTC
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-77646 | WP Windchill PDMLink PTC | 7.7 | Aug 20 | Server Side Request Forgery (SSRF) vulnerability reported in Windchill |
| CVE-2026-77645 | WP Windchill PDMLink PTC | 9.2 | Aug 20 | Critical Remote Code Execution (RCE) vulnerability reported in Windchill |
| CVE-2026-77644 | WR Windchill Risk and Reliability Enterprise Edition (Formerly Relex) PTC | 9.3 | Aug 20 | Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition |
| CVE-2026-12569 RansomwareIn wildKEV | WP Windchill PDMLink PTC | 9.8 | Jun 18 | Remote Code Execution (RCE) vulnerability in Windchill PDMlink |
| CVE-2026-4681 | FL FlexPLM PTC | 9.3 | Mar 23 | Critical Remote Code Execution vulnerability reported in Windchill |
| CVE-2024-40395 | TH Thingworx Ptc | 6.5 | Aug 27 | An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level |
| CVE-2023-29447 | KK Kepware Kepserverex Ptc | 5.3 | Jan 10 | An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication |
| CVE-2023-29446 | KK Kepware Kepserverex Ptc | 4.7 | Jan 10 | An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file |
| CVE-2023-29445 | TI Thingworx Industrial Connectivity Ptc | 7.8 | Jan 10 | An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM |
| CVE-2023-29444 | KK Kepware Kepserverex Ptc | 7.3 | Jan 10 | An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM |
| CVE-2023-5909 | TK Thingworx Kepware Edge Ptc | 7.5 | Nov 30 | KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect |
| CVE-2023-5908 | TK Thingworx Kepware Edge Ptc | 9.1 | Nov 30 | KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information |
| CVE-2023-31200 | VS Vuforia Studio Ptc | 8.0 | Jun 7 | PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack |
| CVE-2023-29502 | VS Vuforia Studio Ptc | 4.3 | Jun 7 | Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path |
| CVE-2023-29168 | VS Vuforia Studio Ptc | 7.5 | Jun 7 | The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication |
| CVE-2023-29152 | VS Vuforia Studio Ptc | 8.1 | Jun 7 | By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account |
| CVE-2023-27881 | VS Vuforia Studio Ptc | 9.9 | Jun 7 | A user could use the “Upload Resource” functionality to upload files to any location on the disk |
| CVE-2023-24476 | VS Vuforia Studio Ptc | 3.3 | Jun 7 | An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are… |
| CVE-2022-2848 | OP Opc-aggregator Ptc | 9.1 | Mar 29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0 |
| CVE-2022-2825 | KK Kepware Kepserverex Ptc | 9.8 | Mar 29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0 |
| CVE-2023-0755 | TK Thingworx Kepware Edge Ptc | 9.8 | Feb 23 | The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code |
| CVE-2023-0754 | KS Kepware Server Ptc | 9.8 | Feb 23 | The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code |
| CVE-2022-25252 | AD Axeda Desktop Server Ptc | 7.5 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception |
| CVE-2022-25251 | AD Axeda Desktop Server Ptc | 9.8 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific… |
| CVE-2022-25250 | AD Axeda Desktop Server Ptc | 7.5 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port… |
| CVE-2022-25249 | AA Axeda Agent Ptc | 7.5 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to… |
| CVE-2022-25248 | AD Axeda Desktop Server Ptc | 5.3 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service |
| CVE-2022-25247 | AD Axeda Desktop Server Ptc | 9.8 | Mar 16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication |
| CVE-2022-25246 | AA Axeda Agent Ptc | 8.8 | Mar 16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation |
| CVE-2020-27267 | TK Thingworx Kepware Server Ptc | 9.1 | Jan 14 | KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer… |
| CVE-2020-27265 | TK Thingworx Kepware Server Ptc | 9.8 | Jan 14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer… |
| CVE-2020-27263 | TK Thingworx Kepware Server Ptc | 9.1 | Jan 14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer… |
| CVE-2018-20092 | TP Thingworx Platform Ptc | 7.5 | Dec 17 | PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request |
| CVE-2018-17218 | TP Thingworx Platform Ptc | 5.4 | Oct 1 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2 |
| CVE-2018-17217 | TP Thingworx Platform Ptc | 7.5 | Oct 1 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2 |
| CVE-2018-17216 | TP Thingworx Platform Ptc | 6.5 | Oct 1 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2 |
| CVE-2015-2061 | CV Creo View Ptc | – | Mar 9 | Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified… |
| CVE-2014-9267 | IS Isoview Ptc | – | Dec 8 | Heap-based buffer overflow in the PTC IsoView ActiveX control allows remote attackers to execute arbitrary code via a crafted ViewPort property value |
| CVE-2007-4600 | MA Mathcad Ptc | – | Oct 18 | The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file,… |