CVE-2026-105412 is an SQL Injection vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.5-1 through 17.5-35. This flaw could allow an attacker with limited privileges to read the Tuleap database. The vulnerability has a high severity rating with a CVSS score of 7.1. No official patch or remediation details are provided in the available data.
CVE-2026-105411 is a high-severity authorization bypass vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. It allows an attacker with tracker administration rights on one tracker to update or delete fields of all trackers on the instance without proper authorization.
CVE-2026-105410 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This flaw allows an attacker to inject and execute arbitrary script code in the browser session of users. The vulnerability is classified as high severity with a CVSS score of 8.7, indicating significant impact on confidentiality and integrity. No information about available patches or vendor advisories is provided.
CVE-2026-105409 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This vulnerability allows an attacker to inject and execute arbitrary script code within the browser session of a user. The vulnerability is classified as CWE-79, indicating improper neutralization of input during web page generation. It has a high severity with a CVSS score of 8.7, reflecting its potential impact on confidentiality and integrity. No information about available patches or vendor advisories is provided. No known exploits in the wild have been reported.
CVE-2026-105408 is a stored Cross-site Scripting (XSS) vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions from 17.0-1 through 17.0-41 and 17.5-1 through 17.5-32. This vulnerability allows an attacker to inject and execute arbitrary script code in the browser session of a user. It has a high severity rating with a CVSS score of 8.7, indicating significant impact on confidentiality and integrity if exploited.
CVE-2026-105407 is an OS Command Injection vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.0-40 and 17.5-1 through 17.5-31. This flaw allows an attacker with limited privileges to execute arbitrary commands on the affected server without user interaction. The vulnerability has a high severity with a CVSS score of 8.8, indicating significant potential impact on confidentiality, integrity, and availability.
A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary code on the server.
An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5 could allow an attacker to execute arbitrary commands on the server.
An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could allow an attacker to gain access to some user accounts.
CVE-2026-19851 is a Use of Default Password vulnerability in Dassault Systèmes Tuleap Enterprise Edition versions 17.0-1 through 17.5-1. This flaw could allow an attacker to gain unauthorized access to user accounts created during XML import. The vulnerability has a high severity with a CVSS score of 7.7, indicating significant confidentiality and integrity impact with low availability impact. No official patch or remediation guidance has been provided yet.
A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution.
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.
An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.
An Improper Authentication vulnerability affecting DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.
A Race Condition vulnerability affecting BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.
A Path Traversal vulnerability affecting SOLIDWORKS Visualize from SOLIDWORKS Desktop Release 2024 through SOLIDWORKS Desktop Release 2026 could allow an attacker to write arbitrary files on the server.
A Stored Cross-site Scripting (XSS) vulnerability affecting Process Experience Studio in DELMIA Service Process Engineer from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x could allow an attacker to execute arbitrary script code in user's browser session.
A Deserialization of Untrusted Data vulnerability affecting Teamwork Cloud from No Magic Release 2022x through No Magic Release 2026x and Magic Collaboration Studio from CATIA Magic Release 2022x through CATIA Magic Release 2026x could lead to an unauthenticated remote code execution.
A Path Traversal vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to read or write files in specific directories on the server.
A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
