1,943 results · Clear filters · Feed
-
High max 7.2VA-26-237-01 3 CVEs
Webkul QloApps multiple vulnerabilities
Webkul QloApps contains a remote code execution and SQL injection vulnerabilities. A remote attacker with administrative privileges could upload executable files and achieve remote code execution or send a crafted SQL query that bypasses validation.
-
High max 8.1ICSA-26-237-01 1 CVE
Rently Smart Home
Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions.
-
High max 8.8ICSA-26-237-02 1 CVE
Zoneminder
Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user.
-
High max 8.8ICSA-26-237-04 1 CVE
PayRange API
Successful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a devices displayed image.
-
High max 7.5ICSA-26-237-05 3 CVEs
Bendix EC80 Brake ECU
Successful exploitation of these vulnerabilities could allow an attacker to cause the loss of ABS functions, steering assist, speedometer, shifting capabilities, or disable automatic traction control.
-
High max 7.1VA-26-233-01 1 CVE
ONNX symlink-following and path-traversal arbitrary file write
A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, c…
-
High max 8.6VA-26-232-02 2 CVEs
Jet Admin Cloud Platform multiple vulnerabilities
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is…
-
High max 7.3
Philips Hue Bridge Pro
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and con…
first Aug 13, 2026 -
High max 7.8
Siemens Simcenter Nastran
Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a malicious string, an attack…
first Aug 11, 2026 -
High max 8.8ICSA-26-230-01 6 CVEs
CISA Malcolm
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.
-
High max 8.8
Hitachi Energy APM Edge Product
Hitachi Energy is aware of Dirty Frag vulnerabilities that affect APM Edge product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please …
first Jul 28, 2026 -
High max 7.8
Siemens Parasolid
Parasolid is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released new versions for the aff…
first Aug 11, 2026 -
High max 7.8
Siemens Simcenter Femap
Simcenter Femap contains two file parsing vulnerabilities that could be triggered when the application reads files in BMP file format. If a user is tricked to open a malicious file with the affected application, this could lead the application to crash or pot…
first Aug 11, 2026 -
High max 7.8
Siemens Solid Edge
Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR, PSM or DFT format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has …
first Aug 11, 2026 -
High max 7.1ICSA-26-225-01 1 CVE
AVEVA Enterprise SCADA
Successful exploitation of this vulnerability could allow an attacker to tamper with serialized data, potentially resulting in code execution during deserialization.
-
High max 8.1ICSA-26-225-05 4 CVEs
ANDRITZ HIPASE-250 and 250 SCALA
Successful exploitation of these vulnerabilities could allow an attacker to read data from the device or gain access to affected workstations.
-
High max 6.1ICSA-26-225-14 1 CVE
Johnson Controls Metasys
Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to sessi…
-
High max 8.1ICSMA-26-225-01 1 CVE
Flow Neuroscience FL-100
Successful exploitation of this vulnerability could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits.
-
High max 7.5
Siemens License Server (SLS)
Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the …
first Aug 11, 2026 -
High max 8.1
Webmin multiple vulnerabilities
Webmin contains multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could impersonate and authenticate as any user.
first Jun 18, 2026 -
High max 8.4VA-26-223-02 1 CVE
Google Turbinia arbitrary command execution
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet.
-
High max 7.8VA-26-223-01 1 CVE
Genkit improper host header validation
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit act…
-
High max 7.1ICSA-26-219-01 5 CVEs
CPDLC over ATN-B1 Vulnerabilities
ATN-B1 CPDLC relies on legacy clear text unauthenticated radio frequency links. Research demonstrates that these characteristics allow unauthorized message injection, denial-of-service conditions, and forced session resets. These vulnerabilities do not consti…
-
High max 7.5
ABB Ability Zenon
ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who succ…
first Jul 30, 2026 -
High max 8.1ICSA-26-216-01 1 CVE
Acrisure KARR BT and DR-100
Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations.
-
High max 8.4ICSMA-26-216-01 1 CVE
Thermo Fisher Applied Biosystems Genetic Analyzers
Successful exploitation of this vulnerability could allow an attacker to modify .fsa/.hid output files, tampering with DNA data and resulting in inaccurate test results.
-
High max 8.4
Schneider Electric IGSS
Schneider Electric is aware of a vulnerability in its IGSS Definition module for the IGSS (Interactive Graphical SCADA System) product. The [IGSS](https://igss.schneider-electric.com/) product is a state-of-the-art SCADA system used for monitoring and control…
first Jul 14, 2026 -
High max 8.8ICSA-26-211-03 1 CVE
Toptech Systems RCU II+ and Multiload II+
Successful exploitation of this vulnerability could allow an attacker to gain full system control and misuse it to access or manipulate connected networks and resources.
-
High max 7.5ICSA-26-211-06 1 CVE
NASA Core Flight System (cFS) Health & Safety (HS) Application
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
-
High max 8.8ICSA-26-211-08 4 CVEs
o6 Automation open62541
Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, cause a denial of service, or potentially execute arbitrary code.
-
High max 7.5ICSA-26-211-10 8 CVEs
MZ Automation GmbH libiec61850
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the device.
-
High max 7.3
Hardy Barth Salia EV Charge Controller (Update A)
Successful exploitation of these vulnerabilities could crash the device being accessed; a buffer overflow condition may allow remote code execution.
first Apr 21, 2026 -
High max 7.4
Siemens SIMATIC S7-PLCSIM Advanced
SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
first Jul 14, 2026 -
High max 8.8ICSA-26-209-05 1 CVE
MikroTik RouterOS and Cloud Hosted Router
Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access.
-
High max 8.8VA-26-204-02 1 CVE
DHIS2 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL querie…
-
High max 7.2
Rockwell Automation ThinManager
Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.
first Jul 14, 2026 -
High max 8.8ICSA-26-204-03 4 CVEs
Weintek cMT3092X
Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.
-
High max 8.1ICSA-26-204-06 4 CVEs
MZ Automation libIEC61850
Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.
-
High max 8.2ICSA-26-204-07 1 CVE
MZ Automation lib60870
Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.
-
High max 7.3VA-26-202-03 1 CVE
FileGator privilege escalation
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission…