PT
Vendor
Ptc
100
CVEs
3
On KEV
0
New 30D
Products
FL9.8
FlexPLM
PTC
4 CVEs1 on KEV0 new
WP9.8
Windchill PDMLink
PTC
4 CVEs1 on KEV0 new
WA9.8
Windchill and FlexPLM
PTC
1 CVEs1 on KEV0 new
TI9.8
Thingworx Industrial Connectivity
Ptc
13 CVEs0 on KEV0 new
TK9.8
Thingworx Kepware Server
Ptc
11 CVEs0 on KEV0 new
KK9.8
Kepware KEPServerEX
PTC
10 CVEs0 on KEV0 new
AA9.8
Axeda Agent
Ptc
7 CVEs0 on KEV0 new
AD9.8
Axeda Desktop Server
Ptc
7 CVEs0 on KEV0 new
OP9.8
Opc-aggregator
Ptc
7 CVEs0 on KEV0 new
TK9.8
Thingworx Kepware Edge
Ptc
6 CVEs0 on KEV0 new
VS9.9
Vuforia Studio
Ptc
6 CVEs0 on KEV0 new
TP7.5
Thingworx Platform
Ptc
4 CVEs0 on KEV0 new
KE9.1
Keepserverex
Ptc
2 CVEs0 on KEV0 new
KS9.8
Kepware Server
Ptc
2 CVEs0 on KEV0 new
KS9.8
Kepware Serverex
Ptc
2 CVEs0 on KEV0 new
TE9.8
Thingworx Edge C-sdk
Ptc
2 CVEs0 on KEV0 new
TE9.8
Thingworx Edge Microserver
Ptc
2 CVEs0 on KEV0 new
TN9.8
Thingworx .net-sdk
Ptc
2 CVEs0 on KEV0 new
CO7.1
Codebeamer
PTC
1 CVEs0 on KEV0 new
CE10.0
Creo Elements/Direct License
PTC
1 CVEs0 on KEV0 new
CV–
Creo View
Ptc
1 CVEs0 on KEV0 new
IS–
Isoview
Ptc
1 CVEs0 on KEV0 new
KT5.3
Kepware ThingWorx Kepware Server
PTC
1 CVEs0 on KEV0 new
MA–
Mathcad
Ptc
1 CVEs0 on KEV0 new
TH6.5
Thingworx
Ptc
1 CVEs0 on KEV0 new
WR9.3
Windchill Risk and Reliability Enterprise Edition (Formerly Relex)
PTC
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-77646 | FL FlexPLM PTC | 7.7 | Aug 20 | Server Side Request Forgery (SSRF) vulnerability reported in Windchill |
| CVE-2026-77645 | WP Windchill PDMLink PTC | 9.2 | Aug 20 | Critical Remote Code Execution (RCE) vulnerability reported in Windchill |
| CVE-2026-77644 | WR Windchill Risk and Reliability Enterprise Edition (Formerly Relex) PTC | 9.3 | Aug 20 | Critical Bypass Access Control Vulnerability Reported for Windchill Risk and Reliability (WRR) Enterprise Edition |
| CVE-2026-12569 RansomwareIn wildKEV | WP Windchill PDMLink PTC | 9.8 | Jun 18 | Remote Code Execution (RCE) vulnerability in Windchill PDMlink |
| CVE-2026-4681 | WP Windchill PDMLink PTC | 9.3 | Mar 23 | Critical Remote Code Execution vulnerability reported in Windchill |
| CVE-2024-40395 | TH Thingworx Ptc | 6.5 | Aug 27 | An Insecure Direct Object Reference (IDOR) in PTC ThingWorx v9.5.0 allows attackers to view sensitive information, including PII, regardless of access level |
| CVE-2024-6098 | KT Kepware ThingWorx Kepware Server PTC | 5.3 | Aug 16 | PTC Kepware ThingWorx Kepware Server Allocation of Resources Without Limits or Throttling |
| CVE-2024-6071 | CE Creo Elements/Direct License PTC | 10.0 | Jun 27 | PTC Creo Elements/Direct License Server Missing Authorization |
| CVE-2024-3951 | CO Codebeamer PTC | 7.1 | May 8 | Cross-site Scripting in PTC Codebeamer |
| CVE-2023-29447 | TI Thingworx Industrial Connectivity Ptc | 5.3 | Jan 10 | An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication |
| CVE-2023-29446 | TK Thingworx Kepware Server Ptc | 4.7 | Jan 10 | An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file |
| CVE-2023-29445 | KK Kepware Kepserverex Ptc | 7.8 | Jan 10 | An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM |
| CVE-2023-29444 | KK Kepware Kepserverex Ptc | 7.3 | Jan 10 | An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM |
| CVE-2023-5909 | TK Thingworx Kepware Edge Ptc | 7.5 | Nov 30 | KEPServerEX does not properly validate certificates from clients which may allow unauthenticated users to connect |
| CVE-2023-5908 | TK Thingworx Kepware Edge Ptc | 9.1 | Nov 30 | KEPServerEX is vulnerable to a buffer overflow which may allow an attacker to crash the product being accessed or leak information |
| CVE-2023-31200 | VS Vuforia Studio Ptc | 8.0 | Jun 7 | PTC Vuforia Studio does not require a token; this could allow an attacker with local access to perform a cross-site request forgery attack or a replay attack |
| CVE-2023-29502 | VS Vuforia Studio Ptc | 4.3 | Jun 7 | Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a different path |
| CVE-2023-29168 | VS Vuforia Studio Ptc | 7.5 | Jun 7 | The local Vuforia web application does not support HTTPS, and federated credentials are passed via basic authentication |
| CVE-2023-29152 | VS Vuforia Studio Ptc | 8.1 | Jun 7 | By changing the filename parameter in the request, an attacker could delete any file with the permissions of the Vuforia server account |
| CVE-2023-27881 | VS Vuforia Studio Ptc | 9.9 | Jun 7 | A user could use the “Upload Resource” functionality to upload files to any location on the disk |
| CVE-2023-24476 | VS Vuforia Studio Ptc | 3.3 | Jun 7 | An attacker with local access to the machine could record the traffic, which could allow them to resend requests without the server authenticating that the user or session are… |
| CVE-2022-2848 | TK Thingworx Kepware Edge Ptc | 9.1 | Mar 29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0 |
| CVE-2022-2825 | KK Kepware Kepserverex Ptc | 9.8 | Mar 29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Kepware KEPServerEX 6.11.718.0 |
| CVE-2023-0755 | TK Thingworx Kepware Edge Ptc | 9.8 | Feb 23 | The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code |
| CVE-2023-0754 | KS Kepware Server Ptc | 9.8 | Feb 23 | The affected products are vulnerable to an integer overflow or wraparound, which could allow an attacker to crash the server and remotely execute arbitrary code |
| CVE-2022-25252 | AD Axeda Desktop Server Ptc | 7.5 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) when receiving certain input throws an exception |
| CVE-2022-25251 | AD Axeda Desktop Server Ptc | 9.8 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain XML messages to a specific… |
| CVE-2022-25250 | AD Axeda Desktop Server Ptc | 7.5 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send a certain command to a specific port… |
| CVE-2022-25249 | AA Axeda Agent Ptc | 7.5 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) (disregarding Axeda agent v6.9.2 and v6.9.3) is vulnerable to… |
| CVE-2022-25248 | AD Axeda Desktop Server Ptc | 5.3 | Mar 16 | When connecting to a certain port Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) supplies the event log of the specific service |
| CVE-2022-25247 | AD Axeda Desktop Server Ptc | 9.8 | Mar 16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication |
| CVE-2022-25246 | AA Axeda Agent Ptc | 8.8 | Mar 16 | Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) uses hard-coded credentials for its UltraVNC installation |
| CVE-2020-27267 | TK Thingworx Kepware Server Ptc | 9.1 | Jan 14 | KEPServerEX v6.0 to v6.9, ThingWorx Kepware Server v6.8 and v6.9, ThingWorx Industrial Connectivity (all versions), OPC-Aggregator (all versions), Rockwell Automation KEPServer… |
| CVE-2020-27265 | TK Thingworx Kepware Server Ptc | 9.8 | Jan 14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer… |
| CVE-2020-27263 | TK Thingworx Kepware Server Ptc | 9.1 | Jan 14 | KEPServerEX: v6.0 to v6.9, ThingWorx Kepware Server: v6.8 and v6.9, ThingWorx Industrial Connectivity: All versions, OPC-Aggregator: All versions, Rockwell Automation KEPServer… |
| CVE-2018-20092 | TP Thingworx Platform Ptc | 7.5 | Dec 17 | PTC ThingWorx Platform through 8.3.0 is vulnerable to a directory traversal attack on ZIP files via a POST request |
| CVE-2018-17218 | TP Thingworx Platform Ptc | 5.4 | Oct 1 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2 |
| CVE-2018-17217 | TP Thingworx Platform Ptc | 7.5 | Oct 1 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2 |
| CVE-2018-17216 | TP Thingworx Platform Ptc | 6.5 | Oct 1 | An issue was discovered in PTC ThingWorx Platform 6.5 through 8.2 |
| CVE-2015-2061 | CV Creo View Ptc | – | Mar 9 | Heap-based buffer overflow in the browser plugin for PTC Creo View allows remote attackers to execute arbitrary code via vectors involving setting a large buffer to an unspecified… |
| CVE-2014-9267 | IS Isoview Ptc | – | Dec 8 | Heap-based buffer overflow in the PTC IsoView ActiveX control allows remote attackers to execute arbitrary code via a crafted ViewPort property value |
| CVE-2007-4600 | MA Mathcad Ptc | – | Oct 18 | The "Protect Worksheet" functionality in Mathsoft Mathcad 12 through 13.1, and PTC Mathcad 14, implements file access restrictions via a protection element in a gzipped XML file,… |