4,105 results · Feed
-
Critical max 9.5ICSA-26-027-04 1 CVE
Johnson Controls Metasys Products
Successful exploitation of this vulnerability could result in remote SQL execution, leading to alteration or loss of data.
-
Critical max 9.0
Axis Communications Camera Station Pro, Camera Station, and Device Manager (Update B)
Successful exploitation of these vulnerabilities could result in an attacker executing arbitrary code, executing a man-in-middle style attack, or bypass authentication.
first Dec 18, 2025 -
Medium max 6.1ICSA-26-022-02 2 CVEs
AutomationDirect CLICK Programmable Logic Controller
Successful exploitation of these vulnerabilities could allow an attacker to impersonate users, escalate privileges, gain unauthorized access to systems and services, and decrypt sensitive data.
-
Medium max 7.1ICSA-26-022-03 1 CVE
Rockwell Automation CompactLogix 5370
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
-
High max 7.1ICSA-26-022-04 1 CVE
Johnson Controls Inc. iSTAR Configuration Utility (ICU) tool
Successful exploitation of this vulnerability could allow an attacker to cause a failure within the operating system of the machine hosting the ICU tool.
-
High max 8.7ICSA-26-022-05 2 CVEs
Weintek cMT X Series HMI EasyWeb Service
Successful exploitation of these vulnerabilities could allow a low-level user to alter privileges and gain full control to the device.
-
Critical max 9.4ICSA-26-022-06 1 CVE
Hubitat Elevation Hubs
Successful exploitation of this vulnerability could allow an authenticated attacker to escalate their privileges and control devices outside of their authorized scope.
-
High max 7.8ICSA-26-022-07 1 CVE
Delta Electronics DIAView
Successful exploitation of this vulnerability could enable an attacker to execute arbitrary code.
-
Critical max 9.4ICSA-26-022-08 3 CVEs
EVMAPA
Successful exploitation of these vulnerabilities could lead to degraded service, a denial-of-service, or unauthorized remote command execution, which could lead to spoofing or a manipulation of charging station statuses.
-
High max 8.1
Schneider Electric Modicon M340, MC80, and Momentum Unity M1E (Update B)
Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M340 / Momentum / MC80 products.Modicon PAC control and monitor industrial operations.Failure to apply the provided remediations/mitigations below may risk unauthorized access …
first Nov 12, 2024 -
High max 8.8
Schneider Electric devices using CODESYS Runtime
Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS runtime system V3 communication server. Many vendors, including Schneider Electric, embed CODESYS in their offers. If successfully exploited, these vulnerabilities could result in a …
first Jul 11, 2023 -
High max 8.8ICSA-26-020-03 2 CVEs
Rockwell Automation Verve Asset Manager
Successful exploitation of these vulnerabilities may allow an attacker to access sensitive information stored in variables within the ADI server.
-
Critical max 9.8VA-26-015-01 1 CVE
NOAA PMEL Live Access Server (LAS) command injection
Sites running NOAA PMEL Live Access Server (LAS) are vulnerable to remote code execution via specially crafted requests that include PyFerret expressions. By leveraging a SPAWN command, a remote, unauthenticated attacker can execute arbitrary OS commands.
-
Critical max 10.0ICSA-26-015-01 7 CVEs
AVEVA Process Optimization
Successful exploitation of these vulnerabilities could enable an attacker to execute remote code, perform SQL injection, escalate privileges, or access sensitive information.
-
Critical max 9.8
Festo Firmware
Incomplete Festo product documentation of remote accessible functions and their required IP ports. Depending on the product a description of the supported features can be found in the product documentation to some extent. Update A, 2022-12-13 Added affected d…
first Nov 29, 2022 -
Medium max 4.3
Siemens RUGGEDCOM ROS
Ruggedcom ROS devices contain a temporary denial of service vulnerability that could allow an attacker to crash and restart the device. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Dec 9, 2025 -
Medium max 6.7
Siemens SINEC Security Monitor
SINEC Security Monitor before V4.10.0 contains multiple vulnerabilities. Siemens has released a new version for SINEC Security Monitor and recommends to update to the latest version.
first Dec 9, 2025 -
High max 8.8
Siemens TeleControl Server Basic
TeleControl Server Basic before V3.1.2.4 contains a local privilege escalation vulnerability that could allow an attacker to run arbitrary code with elevated privileges. Siemens has released a new version for TeleControl Server Basic and recommends to update …
first Jan 13, 2026 -
Critical max 8.6
Siemens OPC UA
The products listed below contain two authentication bypass vulnerabilities that could allow an attacker to gain access to the data managed by the server. Siemens has released new versions for several affected products and recommends to update to the latest v…
first Mar 11, 2025 -
Critical max 9.8
Siemens User Management Component
Siemens User Management Component (UMC) is affected by a heap-based buffer overflow vulnerability which could allow an unauthenticated remote attacker arbitrary code execution. Siemens has released new versions for several affected products and recommends to …
first Dec 16, 2024 -
High max 8.1
Siemens RUGGEDCOM APE1808
Nozomi Networks has published information on vulnerabilities in Nozomi Guardian/CMC. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to upda…
first Aug 12, 2025 -
High max 8.1
Siemens HyperLynx and Industrial Edge App Publisher
Multiple Siemens products are affected by a type confusion vulnerability in Google Chrome prior to 138.0.7204.96. This could allow a remote attacker to perform arbitrary code execution via a crafted HTML page. Siemens has released a new version for Industrial…
first Oct 14, 2025 -
Medium max 6.5
Siemens SCALANCE and RUGGEDCOM
Several Industrial Communication Devices based on SINEC OS before V3.2 contain multiple vulnerabilities that could allow an attacker to circumvent authorization checks and perform actions that exceed the permissions of the "guest" role. Siemens has released n…
first Jun 10, 2025 -
Critical max 9.8
Siemens RUGGEDCOM APE1808
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing furthe…
first Mar 12, 2024 -
High max 6.9
Siemens RUGGEDCOM APE 1808
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version of Fortigate NGFW for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens r…
first Jul 9, 2024 -
Critical max 9.8
Siemens RUGGEDCOM APE1808 with Fortigate NGFW Devices
Fortinet has published information on vulnerabilities in FORTIOS. This advisory lists the related Siemens Industrial products. Siemens has released a new version for RUGGEDCOM APE1808 and recommends to update to the latest version. Siemens is preparing furthe…
first Mar 12, 2024 -
Critical max 9.0
Siemens RUGGEDCOM APE 1808
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Siemens is preparing updates and recommends specific countermeasures for products whe…
first Jul 9, 2024 -
Critical max 10.0
Siemens Industrial Edge Device Kit
Users of Industrial Edge Devices are advised to consult the respective Security Advisories for their devices (for Siemens Industrial Edge devices see Additional Information). Industrial Edge Device Kit contains an authorization bypass vulnerability that could…
first Jan 13, 2026 -
Critical max 9.3
Güralp Systems FMUS Series and MIN Series Devices (Update B)
Successful exploitation of this vulnerability could allow an attacker to modify hardware configurations, manipulate data, or factory reset the device.
first Jul 31, 2025 -
High max 8.7ICSA-26-013-01 1 CVE
Rockwell Automation 432ES-IG3 Series A
Successful exploitation of this vulnerability could result in a denial-of-service condition.
-
High max 8.7ICSA-26-013-02 1 CVE
Rockwell Automation FactoryTalk DataMosaix Private Cloud
Successful exploitation of this vulnerability could allow an attacker to perform unauthorized sensitive database operations.
-
Medium max 5.8ICSA-26-013-03 4 CVEs
YoSmart YoLink Smart Hub
Successful exploitation of these vulnerabilities could allow an attacker to remotely control other users' smart home devices, intercept sensitive data, and hijack sessions.
-
Medium max 4.7VA-26-013-01 1 CVE
NSecKrnl driver terminates system processes with crafted IOCTL requests
NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected Processes by issuing crafted IOCTL requests to the driver.
-
High max 8.4
AzeoTech DAQFactory (Update A)
Successful exploitation of these vulnerabilities requires an attacker to upload a malicious .ctl file. This could lead to information disclosure or arbitrary code execution.
first Dec 11, 2025 -
High max 7.6VA-26-008-01 4 CVEs
OPEXUS eCASE
OPEXUS eCASE Audit contains multiple vulnerabilities. An authenticated attacker could bypass authorization or inject JavaScript that could be executed in the context of other users.
-
Medium max 5.5VA-26-008-03 1 CVE
Ideagen DevonWay stored XSS
Ideagen DevonWay contains a stored cross site scripting vulnerability. A remote, authenticated attacker could craft a payload in the 'Reports' page that executes when another user views the report. Fixed in 2.62.4 and 2.62 LTS.
-
Critical max 8.7
Hitachi Energy Asset Suite
Hitachi Energy is aware of a Jasper Report vulnerability that affects the Asset Suite product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Re…
first Dec 9, 2025 -
Critical max 9.8VA-26-008-02 2 CVEs
OPEXUS eComplaint and eCasePortal IDOR
OPEXUS eCasePortal and eComplaint before version 9.0.45.0 allow an unauthenticated attacker to iterate through predictable URL parameters and download all available files. The eCasePortal vulnerability allows attackers to upload and delete files as well.
-
High max 8.8
Columbia Weather Systems MicroServer
Successful exploitation of these vulnerabilities could allow an attacker to redirect connections to an attacker controlled device, gain admin access to the web portal, or gain limited shell access.
-
Critical max 9.8
Mitsubishi Electric Air Conditioning Systems (Update B)
Successful exploitation of this vulnerability could allow an attacker to bypass authentication to gain unauthorized control of the air conditioning system or access sensitive information stored in the system. The attacker may also use the disclosed sensitive …
first Jun 26, 2025