PTC vulnerabilities
31 CVEs and advisories name PTC as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-77646Server Side Request Forgery (SSRF) vulnerability reported in Windchill
- CVE-2026-77645Critical Remote Code Execution (RCE) vulnerability reported in Windchill
- CVE-2026-77644Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition
- CVE-2026-12569Remote Code Execution (RCE) vulnerability in Windchill PDMlink
- CVE-2026-4681Critical Remote Code Execution vulnerability reported in Windchill
- CVE-2024-6098PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling
- CVE-2024-6071PTC Creo Elements/Direct License Server Missing Authorization
- CVE-2024-3951Cross-site Scripting in PTC Codebeamer
- CVE-2023-29447Insufficiently Protected Credentials in PTC's Kepware KEPServerEX
- CVE-2023-29446Improper Input Validation in PTC's Kepware KEPServerEX
- CVE-2023-29445Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
- CVE-2023-29444Uncontrolled Search Path Element in PTC's Kepware KEPServerEX
- CVE-2023-5909Improper Validation of Certificate with Host Mismatch in PTC KEPServerEx
- CVE-2023-5908Heap Based Buffer Overflow in PTC KEPServerEx
- CVE-2023-4296PTC Codebeamer Cross site scripting
- CVE-2023-3825 PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled res
- CVE-2023-31200PTC Vuforia Studio Cross-Site Request Forgery
- CVE-2023-29502PTC Vuforia Studio Path Traversal
- CVE-2023-27881PTC Vuforia Studio Unrestricted Upload of File with Dangerous Type
- CVE-2023-29152PTC Vuforia Studio Improper Authorization
- CVE-2023-24476PTC Vuforia Studio Improper Authorization
- CVE-2023-29168PTC Vuforia Studio Insufficiently Protected Credentials
- CVE-2023-0754 The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely
- CVE-2023-0755 The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remote
- CVE-2022-25251PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function
- CVE-2022-25252PTC Axeda agent and Axeda Desktop Server Improper Check or Handling Of Exceptional Conditions
- CVE-2022-25250PTC Axeda agent and Axeda Desktop Server Missing Authentication For Critical Function
- CVE-2022-25249PTC Axeda agent and Axeda Desktop Server Path Traversal
- CVE-2022-25248PTC Axeda agent and Axeda Desktop Server Information Exposure
- CVE-2022-25246PTC Axeda agent and Axeda Desktop Server Use of Hard-Coded Credentials