4,097 results · Feed
-
High max 7.1VA-26-251-01 1 CVE
Maono Link local privilege escalation
Maono Link 3.8.13 MaonoAiServices Windows service allows local privilege escalation for a standard user account via improper write privileges in 'C:\ProgramData\Maono'.
-
Medium max 6.8ICSA-26-251-01 1 CVE
CareCam Pro IP Cameras
Successful exploitation of this vulnerability could allow an attacker to take full control of the device.
-
High max 8.7
Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)
Schneider Electric is aware of a vulnerability in the following products: The Easergy C5 is a scalable and interoperable bay controller, protection and merging unit for large and critical infrastructure electrical distribution systems. The Easergy MiCOM P30 i…
first May 12, 2026 -
MediumICSA-26-246-01 0 CVEs
OPCFoundation OPC UA LocalDiscoveryServer (LDS)
Successful exploitation of this vulnerability could allow an attacker to take control of a high-privilege terminal during installation and run arbitrary commands.
-
High max 7.0ICSA-26-246-03 1 CVE
Rockwell Automation ControlFLASH
Successful exploitation of this vulnerability could give an attacker the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level.
-
High max 8.7ICSA-26-246-04 2 CVEs
Rockwell Automation ArmorStart LT
Successful exploitation of these vulnerabilities could result in a loss of webserver availability or allow an attacker to inject malicious scripts that will be executed when other users access the affected page.
-
HighICSA-26-246-05 0 CVEs
Rockwell Automation 1756-ENBT Module
Successful exploitation of this vulnerability could crash the module. The device requires a restart to recover.
-
High max 8.8ICSA-26-246-06 1 CVE
Inductive Automation Ignition
Successful exploitation of this vulnerability could allow any authenticated user to create projects.
-
Critical max 9.8ICSA-26-246-07 1 CVE
Pyramid Solutions NetStaX EtherNet/IP Stack
Successful exploitation of this vulnerability could result in memory corruption, a device crash, or a potential remote attack vector without the originating device receiving a CIP error indicating that the request could not be processed.
-
High max 8.8ICSA-26-246-08 3 CVEs
Tycon Systems TPDIN-Monitor-WEB3
Successful exploitation of these vulnerabilities could allow for an attacker to perform a man-in-the-middle (MitM) attack, cause a factory reset, wipe credentials, or retrieve sensitive information.
-
Critical max 9.8
Tycon Systems TPDIN-Monitor-WEB2 (Update A)
Successful exploitation of these vulnerabilities could result in an attacker accessing sensitive credentials, disrupting connected infrastructure, or manipulating physical equipment, which could present a physical safety risk.
first Jul 21, 2026 -
Medium max 8.8
Mitsubishi Electric Multiple FA Engineering Software Products (Update G)
Multiple Vulnerabilities due to vulnerabilities in Jungo's WinDriver in multiple FA engineering software products. Successful exploitation of these vulnerabilities may allow a local attacker to cause a Windows blue screen error that results in a denial-of-ser…
first May 14, 2024 -
Low max 6.3
Rockwell Automation 1734 POINT I/O (Update A)
Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.
first Jul 21, 2026 -
High max 9.2ICSA-26-244-01 4 CVEs
Rockwell Automation RSLinx Classic
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the affected product.
-
High max 7.0ICSA-26-244-02 2 CVEs
Rockwell Automation Redundancy Module Configuration Tool
Successful exploitation of these vulnerabilities could allow for an attacker to escalate and execute processes with administrator privileges.
-
High max 8.7
-
High max 8.5
-
HighICSA-26-244-05 1 CVE
Rockwell Automation ControlLogix, CompactLogix, CompactLogix 5480, GuardLogix, Compact GuardLogix
-
High max 7.1
Redis TLS pending-data list use-after-free
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the pri…
first Aug 27, 2026 -
High max 7.5
Mitsubishi Electric Multiple FA Products (Update D)
Successful exploitation of this vulnerability could allow a remote attacker to cause a denial-of-service (DoS) condition, a timeout error, or a communication delay by sending a specially crafted UDP packet to the product.
first Apr 25, 2025 -
Medium max 5.9
Mitsubishi Electric CNC Series (Update A)
Successful exploitation of this vulnerability could allow a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition in the affected products.
first Mar 10, 2026 -
Critical max 9.8ICSA-26-239-01 3 CVEs
Xiiaozet LK100W
Successful exploitation of these vulnerabilities could allow an attacker to take control over the device.
-
High max 8.7
All-Line Equipment Company Fuel-Boss
Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary commands or code remotely on affected systems.
-
Medium max 6.9ICSA-26-239-03 1 CVE
Rockwell Automation OTTO Fleet Manager
Successful exploitation of this vulnerability could reduce the computational cost required for an attacker to perform offline brute-force attacks against stored password hashes.
-
Critical max 9.8ICSA-26-239-04 2 CVEs
Applied Systems Engineering ASE2000 V2 Communications Test Set
Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to issue outbound network requests, or intercept the connection to impersonate the trusted peer, complete the TLS handshake,…
-
Critical max 9.8ICSA-26-239-05 13 CVEs
Ebyte NA111-M
Successful exploitation of these vulnerabilities could allow an attacker to fully compromise the device.
-
High max 8.2VA-26-238-01 4 CVEs
ComfyUI stored XSS and path traversal vulnerabilities
ComfyUI contains multiple vulnerabilities, with the most severe impact being that a remote, unauthenticated attacker could read image-decodable files and probe arbitrary host paths.
-
High max 7.2VA-26-237-01 3 CVEs
Webkul QloApps multiple vulnerabilities
Webkul QloApps contains a remote code execution and SQL injection vulnerabilities. A remote attacker with administrative privileges could upload executable files and achieve remote code execution or send a crafted SQL query that bypasses validation.
-
Critical max 9.3
Optigo Networks Visual BACnet Capture Tool / Optigo Visual Networks Capture Tool (Update A)
Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, gain control over the products, or impersonate the web applications.
first Mar 11, 2025 -
Critical max 10.0
Siemens SIMATIC IoT2050 Advanced
SIMATIC IoT2050 Advanced devices running Industrial OS with Node-RED installed contain a missing authentication vulnerability in the Node-RED HTTP interface that could allow an unauthenticated remote attacker to create malicious flows and execute arbitrary co…
first Aug 11, 2026 -
High max 8.1ICSA-26-237-01 1 CVE
Rently Smart Home
Successful exploitation of this vulnerability could allow an attacker to access sensitive information and override user permissions.
-
High max 8.8ICSA-26-237-02 1 CVE
Zoneminder
Successful exploitation of this vulnerability could result in full Remote Code Execution (RCE) as the web server user.
-
High max 8.8ICSA-26-237-04 1 CVE
PayRange API
Successful exploitation of this vulnerability could allow a remote, authenticated or unauthenticated attacker to disclose sensitive information, arbitrarily modify the device to cause a denial of service, or alter a devices displayed image.
-
High max 7.5ICSA-26-237-05 3 CVEs
Bendix EC80 Brake ECU
Successful exploitation of these vulnerabilities could allow an attacker to cause the loss of ABS functions, steering assist, speedometer, shifting capabilities, or disable automatic traction control.
-
Critical max 9.8ICSA-26-237-06 11 CVEs
Ebyte NE2-D11
Successful exploitation of these vulnerabilities could allow an attacker to gain unauthorized administrative access, disclose sensitive information, modify device configuration, hijack authenticated sessions, and disrupt device operation.
-
Critical max 9.1ICSA-26-237-07 2 CVEs
FURUNO FA-50 Class B AIS Transponder
Successful exploitation of these vulnerabilities could allow an attacker to alter device settings.
-
High max 7.1VA-26-233-01 1 CVE
ONNX symlink-following and path-traversal arbitrary file write
A local attacker with write access to the directory where a victim serializes external data can deterministically pre-plant a symlink that is being followed, causing the victim's write to append to any file the victim can write, e.g. ~/.ssh/authorized_keys, c…
-
Medium max 5.3VA-26-232-01 1 CVE
Brushfire unauthenticated information disclosure
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users.
-
High max 8.6VA-26-232-02 2 CVEs
Jet Admin Cloud Platform multiple vulnerabilities
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is…
-
Medium max 6.9ICSA-26-232-01 1 CVE
Johnson Controls Simplex Incident Manager
Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading to unauthorized access to the application and connected sy…