# cve.now: Aveva

The newest entries naming Aveva as an affected vendor (up to 200), of 55 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-81821](https://cve.now/CVE-2026-81821.md): AVEVA Pipeline Integrity Monitor Use of hard-coded cryptographic key (CVSS 8.3)
- [CVE-2026-81822](https://cve.now/CVE-2026-81822.md): AVEVA Pipeline Integrity Monitor Use of a Broken or Risky Cryptographic Algorithm (CVSS 8.3)
- [CVE-2026-81823](https://cve.now/CVE-2026-81823.md): AVEVA Pipeline Integrity Monitor Missing Authorization (CVSS 6.9)
- [CVE-2026-81824](https://cve.now/CVE-2026-81824.md): AVEVA Pipeline Integrity Monitor cross-site scripting (CVSS 6.3)
- [CVE-2025-7639](https://cve.now/CVE-2025-7639.md): AVEVA Enterprise SCADA Deserialization of Untrusted Data (CVSS 6.1)
- [CVE-2026-5387](https://cve.now/CVE-2026-5387.md): AVEVA Pipeline Simulation Missing Authorization (CVSS 9.3)
- [CVE-2026-1507](https://cve.now/CVE-2026-1507.md): Uncaught Exception vulnerability in AVEVA PI Data Archive (CVSS 7.5)
- [CVE-2026-1495](https://cve.now/CVE-2026-1495.md): Insertion of Sensitive Information into Log File vulnerability in AVEVA PI to CONNECT Agent (CVSS 6.5)
- [CVE-2025-64769](https://cve.now/CVE-2025-64769.md): AVEVA Process Optimization Cleartext Transmission of Sensitive Information (CVSS 7.1)
- [CVE-2025-65117](https://cve.now/CVE-2025-65117.md): AVEVA Process Optimization Use of Potentially Dangerous Function (CVSS 7.4)
- [CVE-2025-64729](https://cve.now/CVE-2025-64729.md): AVEVA Process Optimization Missing Authorization (CVSS 8.1)
- [CVE-2025-65118](https://cve.now/CVE-2025-65118.md): AVEVA Process Optimization Uncontrolled Search Path Element (CVSS 8.8)
- [CVE-2025-61943](https://cve.now/CVE-2025-61943.md): AVEVA Process Optimization SQL Injection (CVSS 8.4)
- [CVE-2025-64691](https://cve.now/CVE-2025-64691.md): AVEVA Process Optimization Code Injection (CVSS 8.8)
- [CVE-2025-61937](https://cve.now/CVE-2025-61937.md): AVEVA Process Optimization Code Injection (CVSS 10.0)
- [CVE-2025-8386](https://cve.now/CVE-2025-8386.md): AVEVA Application Server IDE Basic Cross-site Scripting (CVSS 6.9)
- [CVE-2025-9317](https://cve.now/CVE-2025-9317.md): AVEVA Edge Use of a Broken or Risky Cryptographic Algorithm (CVSS 8.4)
- [CVE-2025-54460](https://cve.now/CVE-2025-54460.md): AVEVA PI Integrator Unrestricted Upload of File with Dangerous Type (CVSS 7.1)
- [CVE-2025-41415](https://cve.now/CVE-2025-41415.md): AVEVA PI Integrator Insertion of Sensitive Information into Sent Data (CVSS 6.5)
- [CVE-2025-36539](https://cve.now/CVE-2025-36539.md): AVEVA PI Data Archive Uncaught Exception (CVSS 6.5)
- [CVE-2025-44019](https://cve.now/CVE-2025-44019.md): AVEVA PI Data Archive Uncaught Exception (CVSS 7.1)
- [CVE-2025-2745](https://cve.now/CVE-2025-2745.md): AVEVA PI Web API Cross-site Scripting (CVSS 6.5)
- [CVE-2025-4418](https://cve.now/CVE-2025-4418.md): AVEVA PI Connector for CygNet Improper Validation of Integrity Check Value (CVSS 4.4)
- [CVE-2025-4417](https://cve.now/CVE-2025-4417.md): AVEVA PI Connector for CygNet Cross-site Scripting (CVSS 5.5)
- [CVE-2024-6456](https://cve.now/CVE-2024-6456.md): SQL Injection vulnerability in AVEVA Historian Server (CVSS 8.5)
- [CVE-2024-6619](https://cve.now/CVE-2024-6619.md): Incorrect Permission Assignment for Critical Resource in Ocean Data Systems Dream Report (CVSS 8.5)
- [CVE-2024-6618](https://cve.now/CVE-2024-6618.md): Path Traversal in Ocean Data Systems Dream Report (CVSS 8.5)
- [CVE-2024-7113](https://cve.now/CVE-2024-7113.md): Allocation of Resources Without Limits or Throttling in AVEVA SuiteLink Server (CVSS 8.7)
- [CVE-2024-3468](https://cve.now/CVE-2024-3468.md): Deserialization of Untrusted Data in AVEVA PI Web API (CVSS 8.4)
- [CVE-2024-3467](https://cve.now/CVE-2024-3467.md): Deserialization of Untrusted Data in AVEVA PI Asset Framework Client (CVSS 7.0)
- [CVE-2023-6132](https://cve.now/CVE-2023-6132.md): AVEVA Edge products Uncontrolled Search Path Element (CVSS 7.3)
- [CVE-2023-34348](https://cve.now/CVE-2023-34348.md): Improper Check or Handling of Exceptional Conditions in Aveva PI Server (CVSS 7.5)
- [CVE-2023-31274](https://cve.now/CVE-2023-31274.md): Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server (CVSS 5.3)
- [CVE-2023-34982](https://cve.now/CVE-2023-34982.md): AVEVA Operations Control Logger External Control of File Name or Path (CVSS 5.5)
- [CVE-2023-33873](https://cve.now/CVE-2023-33873.md): AVEVA Operations Control Logger Execution with Unnecessary Privileges (CVSS 7.8)
- [CVE-2022-36970](https://cve.now/CVE-2022-36970.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 20.0 Build: 4201.2111.1802.0000 (CVSS 7.8)
- [CVE-2022-36969](https://cve.now/CVE-2022-36969.md): This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2 (CVSS 5.5)
- [CVE-2022-28688](https://cve.now/CVE-2022-28688.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802 (CVSS 7.8)
- [CVE-2022-28687](https://cve.now/CVE-2022-28687.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802 (CVSS 7.8)
- [CVE-2022-28686](https://cve.now/CVE-2022-28686.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802 (CVSS 7.8)
- [CVE-2022-28685](https://cve.now/CVE-2022-28685.md): This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802 (CVSS 7.8)
- [CVE-2023-1256](https://cve.now/CVE-2023-1256.md): CVE-2023-1256 (CVSS 9.8)
- [CVE-2022-23854](https://cve.now/CVE-2022-23854.md): AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user (CVSS 7.5)
- [CVE-2021-38410](https://cve.now/CVE-2021-38410.md): AVEVA PCS Portal Uncontrolled Search Path Element (CVSS 7.3)
- [CVE-2022-1467](https://cve.now/CVE-2022-1467.md): AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere (CVSS 7.4)
- [CVE-2022-0835](https://cve.now/CVE-2022-0835.md): AVEVA System Platform Cleartext Storage of Sensitive Information in Memory (CVSS 8.1)
- [CVE-2021-33008](https://cve.now/CVE-2021-33008.md): AVEVA System Platform Missing Authentication for Critical Function (CVSS 8.8)
- [CVE-2021-32981](https://cve.now/CVE-2021-32981.md): AVEVA System Platform Path Traversal (CVSS 7.2)
- [CVE-2021-32985](https://cve.now/CVE-2021-32985.md): AVEVA System Platform Origin Validation Error (CVSS 7.2)
- [CVE-2021-33010](https://cve.now/CVE-2021-33010.md): AVEVA System Platform Uncaught Exception (CVSS 7.5)
- [CVE-2021-32977](https://cve.now/CVE-2021-32977.md): AVEVA System Platform Improper Verification of Cryptographic Signature (CVSS 7.2)
- [CVE-2021-32942](https://cve.now/CVE-2021-32942.md): The vulnerability could expose cleartext credentials from AVEVA InTouch Runtime 2020 R2 and all prior versions (WindowViewer) if an authoriz (CVSS 6.6)
- [CVE-2019-13537](https://cve.now/CVE-2019-13537.md): The IEC870IP driver for AVEVA’s Vijeo Citect and Citect SCADA and Schneider Electric’s Power SCADA Operation has a buffer overflow vulnerabi (no CVSS)
- [CVE-2019-10981](https://cve.now/CVE-2019-10981.md): In Vijeo Citect 7.30 and 7.40, and CitectSCADA 7.30 and 7.40, a vulnerability has been identified that may allow an authenticated local user (no CVSS)
- [CVE-2019-6525](https://cve.now/CVE-2019-6525.md): AVEVA Wonderware System Platform 2017 Update 2 and prior uses an ArchestrA network user account for authentication of system processes and i (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/aveva
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.