900 results · Clear filters · Feed
-
Medium max 5.5
Hitachi Energy PCM600 (Update A)
Hitachi Energy is aware of a vulnerability that affects the Hitachi Energy PCM600 product versions listed in this document. An attacker successfully exploiting this vulnerability can impact integrity of the product. Please refer to the Recommended Immediate A…
first Apr 28, 2026 -
Medium max 6.8
Siemens Mendix SAML Module
Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for…
first Oct 26, 2026 -
Medium max 5.3
Siemens Capital Embedded AR Classic
The products listed below contain an out-of-bounds read vulnerability that could allow an attacker to cause abnormal product behavior, instability, or denial of service. Siemens has released a new version for Capital Embedded AR Classic R20-11 and recommends …
first Oct 13, 2026 -
Medium max 5.8
Siemens SENTRON 3NA COM Fuse
SENTRON 3NA COM Fuse contains a Denial-of-Service vulnerability. Improper handling of a network management message could allow an attacker to trigger a denial-of-service (DoS) condition. Successful exploitation may require the affected network to be re-establ…
first Oct 13, 2026 -
Medium max 6.7
Siemens Software Center
The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution …
first Oct 15, 2026 -
Medium max 6.5ICSMA-26-288-01 1 CVE
Thermo Fisher Torrent Suite Software
Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server.
-
Medium max 6.2ICSA-26-286-02 3 CVEs
Swann Communications SWIFI-SE2KIC
Successful exploitation of these vulnerabilities could allow an attacker to view video information without authentication.
-
Medium max 7.5
Hitachi Energy REB500
Hitachi Energy is aware of open-source software vulnerabilities that affect REB500 product versions listed in this document. These vulnerabilities can be exploited to carry out Denial of Service (DoS) attack on the product. Please refer to the Recommended Imm…
first Sep 29, 2026 -
Medium max 6.5VA-26-275-02 2 CVEs
C-Open CANopen stack multiple vulnerabilities
RT-Labs AB C-Open CANopen contains a NULL pointer dereference and a write protection bypass vulnerability. These vulnerabilities can potentially crash the device or allow any CANopen node to overwrite read-only OD entries using two SDO frames.
-
Medium max 6.5VA-26-275-04 1 CVE
wormhole.app WebRTC TURN relay
Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP.
-
Medium max 6.4ICSA-26-274-03 2 CVEs
ABB Protection and Control IED Manager PCM600
Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges or overwrite files.
-
Medium max 7.3ICSA-26-274-05 1 CVE
Johnson Controls EasyIO Neo Series EC and CW Controllers
Successful exploitation of this vulnerability could allow an attacker tointercept and read sensitive information, including credentials andsession data.
-
Medium max 6.1
Siemens Mendix Studio Pro
Mendix Studio Pro contains a vulnerability in the module installation process, that could allow an attacker to write or modify arbitrary files in directories outside a developer’s project directory. Siemens has released new versions for the affected products …
first Jun 12, 2025 -
Medium max 5.5VA-26-267-01 1 CVE
Araxis Merge
Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and does not apply sufficient cryptographic protection. An authenticated, non-administrative user could retrieve and unencr…
-
Medium max 6.5
Siemens WTV676 and WTV776
The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode under certain conditions. This disables remote connectivity functions (Web Access) to the devices. Siemens has released …
first Sep 16, 2026 -
Medium max 6.1ICSA-26-265-09 1 CVE
OpenPLC Runtime v3
Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives.
-
Medium max 7.3
Schneider Electric NetBotz 5 750/755
Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring ca…
first Aug 11, 2026 -
Medium max 6.9
Schneider Electric PowerChute Serial Shutdown
Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and works…
first Aug 11, 2026 -
Medium max 4.0VA-26-258-01 1 CVE
Newell Brands DYMO Connect Desktop improper file path validation
The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope.
-
Medium max 6.1
Siemens Teamcenter
A reflected cross site scripting vulnerability in the authentication redirect flow (/auth/) of Teamcenter allows an unauthenticated remote attacker to inject JavaScript into an authenticated user's session by crafting a malicious URL. Successful exploitation …
first Sep 8, 2026 -
Medium max 5.9
Schneider Electric SCADAPack x70 Products
Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring …
first Sep 8, 2026 -
Medium max 6.8ICSA-26-251-01 1 CVE
CareCam Pro IP Cameras
Successful exploitation of this vulnerability could allow an attacker to take full control of the device.
-
MediumICSA-26-246-01 0 CVEs
OPCFoundation OPC UA LocalDiscoveryServer (LDS)
Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands.
-
Medium max 8.8
Mitsubishi Electric Multiple FA Engineering Software Products (Update G)
Multiple Vulnerabilities due to vulnerabilities in Jungo's WinDriver in multiple FA engineering software products. Successful exploitation of these vulnerabilities may allow a local attacker to cause a Windows blue screen error that results in a denial-of-ser…
first May 14, 2024 -
Medium max 5.9
Mitsubishi Electric CNC Series (Update A)
Successful exploitation of this vulnerability could allow a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition in the affected products.
first Mar 10, 2026 -
Medium max 6.9ICSA-26-239-03 1 CVE
Rockwell Automation OTTO Fleet Manager
Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes.
-
Medium max 5.3VA-26-232-01 1 CVE
Brushfire unauthenticated information disclosure
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users.
-
Medium max 6.9ICSA-26-232-01 1 CVE
Johnson Controls Simplex Incident Manager
Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading to unauthorized access to the application and connected sy…
-
Medium max 4.3
Siemens Desigo DXR and PXC Controllers
A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sending malformed BACnet packets. Recovery requires a device reset or reboot to restore normal functionality. Siemens h…
first Aug 11, 2026 -
Medium max 6.8
Siemens LOGO! Soft Comfort
Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vulnerabilities to extract the master key, allowing them to decrypt project data or remove proje…
first Aug 11, 2026 -
Medium max 7.0ICSA-26-225-03 2 CVEs
Johnson Controls Inc. Airwall
Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read arbitrary files on the system, or gain unauthorized access to protected system resources.
-
Medium max 6.1
Siemens RUGGEDCOM APE1808
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigati…
first Aug 11, 2026 -
Medium max 2.9ICSA-26-218-02 1 CVE
Johnson Controls Inc. TL280
Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device.
-
Medium max 4.3ICSMA-26-218-01 1 CVE
Medixant RadiAnt DICOM
Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file is opened.
-
Medium max 5.0VA-26-212-01 1 CVE
SNOMED International Snowstorm reflected XSS
SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. The function does not properly validate user input, allowing an attacker to inject arbitrary JavaScript which will execute upon a target us…
-
Medium max 5.3
Deloitte AI Assist for Customer multiple vulnerabilities
Deloitte AI Assist for Customer contained multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could read or write data to the RAG corpus or make limited modifications to configurations.
first Jul 10, 2026 -
Medium max 5.7
Watchfire Controller Software
Successful exploitation of this vulnerability could allow a malicious user the ability to deliver malicious firmware that can update and gain full control of the controller.
-
Medium max 4.9ICSA-26-211-01 1 CVE
MikroTik RouterOS
Successful exploitation of this vulnerability could allow an attacker to extract the router's WireGuard private key in plaintext using only low‑privilege API access, enabling full VPN impersonation and decryption of all associated traffic.
-
Medium max 8.2ICSA-26-211-05 1 CVE
Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
-
Medium max 6.5ICSA-26-211-11 2 CVEs
MZ Automation lib60870
Successful exploitation of these vulnerabilities could crash the device being accessed.