900 results · Clear filters · Feed
-
Medium max 6.4
ABB KNX Update Tool
ABB has been contacted by a researcher who identified a vulnerability in one of its products. ABB has been contacted by a researcher who identified a vulnerability in one of its products. The vulnerability report has been shared in responsible disclosure. An …
first Jul 17, 2026 -
Medium max 5.3ICSA-26-209-06 1 CVE
igloohome Smart Lock Mobile Application
Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services.
-
Medium max 5.3VA-26-202-02 1 CVE
Trezor Safe improper security check in on-device display
Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed cal…
-
Medium max 7.6
Cloudflare Universal SSL CAA record override
Cloudflare Universal SSL automatically manages the CAA RRset for customer zones in order to issue and renew TLS certificates. In affected Universal SSL configurations, Cloudflare authoritative DNS can serve an auto-managed CAA RRset at query time that superse…
first Jul 2, 2026 -
Medium max 6.7
Siemens IAM Client
Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to upd…
first Jul 14, 2026 -
Medium max 6.4VA-26-197-01 1 CVE
remorses/genql code injection
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when th…
-
Medium max 6.5ICSA-26-197-07 1 CVE
SALTO ProAccess Space
Successful exploitation of this vulnerability allows an authenticated attacker to escalate privileges and access spaces outside their assigned partition, within the same Salto ProAccess Space installation or system. Exploitation requires valid authenticated o…
-
Medium max 8.4ICSA-26-197-09 1 CVE
Rockwell Automation FactoryTalk DataMosaix
Successful exploitation of this vulnerability could allow an authenticated attacker to inject malicious scripts on the server.
-
Medium max 6.4
Inductive Automation Ignition (Update A)
Successful exploitation of this vulnerability could allow an attacker to be granted direct SYSTEM-level code execution on the host operating system running the Ignition Gateway service on Windows systems.
first Dec 18, 2025 -
Medium max 4.4
ABB Advant Master Online Builder
ABB became aware of vulnerability in the products versions listed as affected in the advisory, where an incorrect version of Online Builder (ONB) was included in the media. An update is available that resolves the vulnerability, see details in Recommended imm…
first Jun 23, 2026 -
Medium max 5.3VA-26-190-02 1 CVE
Superior Court of California Hearing Reminder Service unauthenticated information disclosure
The Hearing Reminder Service for the Superior Court of California at https://www.hrs.courts.ca.gov exposes an API endpoint that returns sensitive court reminder records without authentication.
-
Medium max 6.5
Siemens Industrial Products
Several industrial products contain an out of bounds read vulnerability that could allow an attacker to cause a Blue Screen of Death (BSOD) crash of the underlying Windows kernel, leading to denial of service condition. Siemens has released new versions for s…
first May 14, 2024 -
Medium max 6.9
Schneider Electric PowerChute Serial Shutdown
Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The [PowerChute Serial Shutdown](https://www.se.com/ww/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling gr…
first Apr 14, 2026 -
Medium max 6.9
Schneider Electric Easergy MiCOM Px40 Series
Schneider Electric is aware of a vulnerability in its Easergy MiCOM Px40 Series products. The [Easergy MiCOM Px40](https://www.se.com/ww/en/product-subcategory/4725-easergy-micom-px40-series/?filter=business-6-medium-voltage-distribution-and-grid-automation) …
first Apr 14, 2026 -
Medium max 5.4
Siemens Mendix Studio Pro
Mendix Studio Pro versions before V11.12 are affected by a file parsing vulnerability that could be triggered when the application reads specially crafted malicious project during the build pipeline. This could allow an attacker to execute arbitrary code in t…
first Jun 30, 2026 -
Medium max 5.9ICSA-26-188-07 2 CVEs
Digi International PortServer TS, Digi One SP IA
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication and gain access to restricted resources, obtain credentials, and inject malicious scripts.
-
Medium max 5.9
Mitsubishi Electric CNC Series (Update D)
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial of service (DoS) condition in Mitsubishi Electric CNC Series by sending specially crafted packets to TCP port 683, causing an emergency stop.
first Oct 17, 2024 -
Medium max 3.3ICSA-26-183-02 1 CVE
CubeSpace CW0057 Reaction Wheel
Successful exploitation of this vulnerability could allow an attacker to upload arbitrary malicious firmware to the device.
-
Medium max 7.1
Schneider Electric EcoStruxure IT Data Center Expert
Schneider Electric is aware of a vulnerability in its EcoStruxure™ IT Data Center Expert. The EcoStruxure™ IT Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a compre…
first Jun 9, 2026 -
Medium max 6.4
Zero Motorcycles Firmware (Update A)
Successful exploitation of this vulnerability could allow an attacker to pair via Bluetooth with a motorcycle, gaining unauthorized access to all Bluetooth functions, including changing the firmware.
first Apr 21, 2026 -
Medium max 6.1
Siemens SIPROTEC 5 Using DIGSI5 Protocol
SIPROTEC 5 is vulnerable to arbitrary file uploads by authenticated users using the DIGSI 5 protocol. This could allow an attacker to upload malicious configuration files, potentially causing a permanent denial of service condition. As a mitigation measure, u…
first Jun 9, 2026 -
Medium max 6.6
ABB Freelance Security Lock
ABB is aware of a vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the product to stop or make the product inaccessible.
first Jun 10, 2026 -
Medium max 6.5ICSMA-26-169-01 2 CVEs
Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT
Successful exploitation of these vulnerabilities could allow an attacker to obtain sensitive health-related information and prevent legitimate users from establishing a connection with the device.
-
Medium max 5.5
Schneider Electric Uni-Telway Driver (Update D)
Schneider Electric is aware of a vulnerability in its [Uni-Telway driver](https://www.se.com/us/en/product-range/573-unitelway/#overview) which is part of [EcoStruxure™ Control Expert](https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unit…
first Feb 11, 2025 -
Medium max 6.5
Schneider Electric Modicon M340, BMXNOE0100, and BMXNOE0110 (Update A)
Schneider Electric is aware of a vulnerability in its Modicon M340 and BMXNOE0100 and BMXNOE0110 products. The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network modules used with Modicon M340. Failure to apply the mit…
first Jun 11, 2024 -
Medium max 4.4
Hitachi Energy MACH HiDraw
Hitachi Energy is aware of a buffer overflow vulnerability that affects MACH HiDraw product versions listed in this document. Successful exploitation of this vulnerability could lead to a buffer overflow condition, potentially resulting in application outages…
first May 26, 2026 -
Medium max 6.3ICSA-26-155-01 1 CVE
NAVTOR NavBox
Successful exploitation of this vulnerability could allow a local attacker to gain unauthorized access to SOAP methods, resulting in a disruption of operations.
-
Medium max 5.0VA-26-152-01 1 CVE
DeepAI.org CSRF
The DeepAI.org endpoint `https://api.deepai.org/change_user_email` accepts POST requests without any CSRF protection. If a logged-in user is tricked into visiting a malicious HTML page, an attacker can change the user's email address to their own and take ove…
-
Medium max 6.8
ABB Busch-Welcome 2 Wire Door Opener Actuator
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could gain physical, unauthorized access to a Building where the product is installed
first Jul 21, 2025 -
Medium max 5.8
ABB AC500 V2
ABB became aware of vulnerabilities in AC500 V2 listed as affected in the advisory. An attacker who successfully exploited this vulnerability could access fragments of Modbus telegrams that have been sent earlier by that PLC
first Jul 23, 2025 -
Medium max 5.3
Schneider Electric Altivar Products, ATVdPAC Module, ILC992 InterLink Converter (Update B)
Schneider Electric is aware of a vulnerability in its [ATVdPAC module](http://www.se.com/ww/en/product/VW3A3530D/atv-dpac-module/) / [ATV6000 Medium Voltage Altivar Process Drives](http://www.se.com/ww/en/product-range/65607-altivar-process-atv6000) / [ATV630…
first Sep 9, 2025 -
Medium max 6.8
ABB Terra AC
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a…
first Oct 20, 2025 -
Medium max 5.9
Hitachi Energy GMS600
Hitachi Energy is aware of the vulnerability, CVE-2022-4304 in the OSS component OpenSSL, that affects the GMS600 versions that are listed below. An attacker successfully exploiting this vulnerability could send trial messages to the server and record the tim…
first Jun 27, 2023 -
Medium max 6.1
ABB Terra AC Wallbox
ABB is aware of vulnerabilities in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause the pollution of heap memory which potentially takes remote control of the product and performs a…
first Sep 16, 2025 -
Medium max 6.1
ABB B&R Automation Runtime
An update is available that resolves a vulnerability identified by B&Rs internal security analysis in the product versions listed as affected in this advisory. An attacker who successfully exploited these vulnerabilities could take over a remote session or ex…
first Oct 7, 2025 -
Medium max 6.8
Schnieider Electric EcoStruxure Machine Expert HVAC (SEVD-2026-132-01)
Schneider Electric is aware of a vulnerability in its EcostruxureTM Machine Expert HVAC product. The [EcostruxureTM Machine Expert HVAC](https://www.se.com/ww/en/download/document/EcoStruxureME_HVAC/) product is a programming software for Modicon M171-M172 lo…
first May 12, 2026 -
Medium max 5.8VA-26-138-02 1 CVE
Technitium DNS Amplification
Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records. An attacker in control of a domain can cause a vulnerable system to generate excessive network traffic.
-
Medium max 5.7
ABB 800xA Base (Update A)
ABB is aware of a vulnerability in the product versions listed as affected in the advisory. An attacker who successfully exploited this vulnerability could cause services to crash and restart by sending specifically crafted messages. The vulnerability only af…
first Jun 5, 2024 -
Medium max 5.3ICSA-26-139-05 1 CVE
Kieback & Peter DDC Building Controllers
Successful exploitation of this vulnerability could allow an attacker to take control of the victim's browser.
-
Medium max 5.3
Siemens SIPROTEC 5
A sensitive data exposure vulnerability in SIPROTEC 5 can allow an attacker to retrieve sensitive session data from browser history, logs, or other storage mechanisms, potentially leading to unauthorized access. Siemens is preparing fix versions and recommend…
first Jul 8, 2025