4,100 results · Feed
-
Medium max 5.3VA-26-232-01 1 CVE
Brushfire unauthenticated information disclosure
The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users.
-
High max 8.6VA-26-232-02 2 CVEs
Jet Admin Cloud Platform multiple vulnerabilities
Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is…
-
Medium max 6.9ICSA-26-232-01 1 CVE
Johnson Controls Simplex Incident Manager
Successful exploitation of this vulnerability could allow a local attacker with low privileges to extract user credentials (passwords and authentication tokens) from system memory, potentially leading to unauthorized access to the application and connected sy…
-
High max 7.3
Philips Hue Bridge Pro
The Signify Philips Hue Bridge Pro firmware embeds a Mosquitto MQTT broker (v2.0.22) that listens on all network interfaces with anonymous access enabled and no firewall restriction. An attacker with access to the Bridge's network can read device data and con…
first Aug 13, 2026 -
High max 7.8
Siemens Simcenter Nastran
Simcenter Nastran is affected by a stack overflow vulnerability that could be triggered when an application binary reads arbitrary string as a file argument. If a user is tricked to run one of the impacted application binary with a malicious string, an attack…
first Aug 11, 2026 -
High max 8.8ICSA-26-230-01 6 CVEs
CISA Malcolm
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition or execute arbitrary code.
-
High max 8.8
Hitachi Energy APM Edge Product
Hitachi Energy is aware of Dirty Frag vulnerabilities that affect APM Edge product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please …
first Jul 28, 2026 -
Medium max 4.3
Siemens Desigo DXR and PXC Controllers
A vulnerability in Desigo DXR and PXC controllers has been identified that could allow an attacker to cause denial of service conditions by sending malformed BACnet packets. Recovery requires a device reset or reboot to restore normal functionality. Siemens h…
first Aug 11, 2026 -
Critical max 9.1
Siemens Siveillance Video
Siveillance Video Management Servers contains a vulnerability that could allow a Remote Code Execution attack. Siemens has released new versions for the affected products and recommends to update to the latest versions.
first Aug 11, 2026 -
High max 7.8
Siemens Parasolid
Parasolid is affected by an out of bounds read vulnerability that could be triggered when the application reads files in X_T format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has released new versions for the aff…
first Aug 11, 2026 -
High max 7.8
Siemens Simcenter Femap
Simcenter Femap contains two file parsing vulnerabilities that could be triggered when the application reads files in BMP file format. If a user is tricked to open a malicious file with the affected application, this could lead the application to crash or pot…
first Aug 11, 2026 -
High max 7.8
Siemens Solid Edge
Solid Edge is affected by multiple file parsing vulnerabilities that could be triggered when the application reads specially crafted files in PAR, PSM or DFT format. This could allow an attacker to crash the application or execute arbitrary code. Siemens has …
first Aug 11, 2026 -
Medium max 6.8
Siemens LOGO! Soft Comfort
Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vulnerabilities to extract the master key, allowing them to decrypt project data or remove proje…
first Aug 11, 2026 -
High max 7.1ICSA-26-225-01 1 CVE
AVEVA Enterprise SCADA
Successful exploitation of this vulnerability could allow an attacker to tamper with serialized data, potentially resulting in code execution during deserialization.
-
Critical max 10.0ICSA-26-225-02 1 CVE
Haiwell IoT Cloud HMI Gateway
Successful exploitation of this vulnerability may allow an attacker to inject and execute arbitrary OS commands with root privileges.
-
Medium max 7.0ICSA-26-225-03 2 CVEs
Johnson Controls Inc. Airwall
Successful exploitation of these vulnerabilities could allow an attacker to decrypt sensitive data, bypass authentication controls, gaining unauthorized access to read arbitrary files on the system, or gain unauthorized access to protected system resources.
-
High max 8.1ICSA-26-225-05 4 CVEs
ANDRITZ HIPASE-250 and 250 SCALA
Successful exploitation of these vulnerabilities could allow an attacker to read data from the device or gain access to affected workstations.
-
High max 6.1ICSA-26-225-14 1 CVE
Johnson Controls Metasys
Successful exploitation of this vulnerability could allow a low-privilege user or attacker to inject a persistent malicious payload via a crafted URL that executes in the context of other users' sessions, including administrators, potentially leading to sessi…
-
High max 8.1ICSMA-26-225-01 1 CVE
Flow Neuroscience FL-100
Successful exploitation of this vulnerability could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits.
-
Medium max 6.1
Siemens RUGGEDCOM APE1808
Fortinet has published information on vulnerabilities in FortiOS. This advisory lists the related Siemens Industrial products. Siemens recommends to contact customer support for additional information, and follow Fortinet advisory for workarounds and mitigati…
first Aug 11, 2026 -
High max 7.5
Siemens License Server (SLS)
Siemens License Server is affected by multiple vulnerabilities which could allow an attacker to elevate its privileges and read arbitrary files on the system. Siemens has released a new version for Siemens License Server (SLS) and recommends to update to the …
first Aug 11, 2026 -
High max 8.1
Webmin multiple vulnerabilities
Webmin contains multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could impersonate and authenticate as any user.
first Jun 18, 2026 -
High max 8.4VA-26-223-02 1 CVE
Google Turbinia arbitrary command execution
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet.
-
High max 7.8VA-26-223-01 1 CVE
Genkit improper host header validation
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit act…
-
Critical max 8.7
Johnson Controls C-CURE 9000 and Victor application server (Update A)
Successful exploitation of these vulnerabilities could allow an attacker with network access to achieve remote code execution.
first Jul 23, 2026 -
Critical max 9.8ICSMA-26-223-01 8 CVEs
Mira Hormone Monitor, Mira Android App
Successful exploitation of these vulnerabilities could allow an attacker to access unauthorized health profile information, make changes to health information, cause a denial-of-service condition, disclose session token information, and obtain control of user…
-
Critical max 10.0
Metabase SQL injection
Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL. In the worst case an attacker could gain administrative privileges.
-
High max 7.1ICSA-26-219-01 5 CVEs
CPDLC over ATN-B1 Vulnerabilities
ATN-B1 CPDLC relies on legacy clear text unauthenticated radio frequency links. Research demonstrates that these characteristics allow unauthorized message injection, denial-of-service conditions, and forced session resets. These vulnerabilities do not consti…
-
High max 7.5
ABB Ability Zenon
ABB is aware of publicly reported vulnerabilities affecting MongoDB 4.2, which is bundled within the IIoT Services of the affected product versions. MongoDB 4.2 has reached end-of-life and contains multiple known security vulnerabilities. An attacker who succ…
first Jul 30, 2026 -
Medium max 2.9ICSA-26-218-02 1 CVE
Johnson Controls Inc. TL280
Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device.
-
Medium max 4.3ICSMA-26-218-01 1 CVE
Medixant RadiAnt DICOM
Successful exploitation of this vulnerability could allow an attacker to cause the application to crash if a maliciously crafted DICOM file is opened.
-
Critical max 9.8VA-26-216-01 3 CVEs
IxChariot Endpoint buffer overflow
Keysight IxChariot Endpoint, Hawkeye, IxTap, IxByPass, and IxProbe contain one or more buffer overflow vulnerabilities. In the worst case, a remote unauthenticated attacker could execute arbitrary code.
-
Medium max 5.0VA-26-212-01 1 CVE
SNOMED International Snowstorm reflected XSS
SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. The function does not properly validate user input, allowing an attacker to inject arbitrary JavaScript which will execute upon a target us…
-
Medium max 5.3
Deloitte AI Assist for Customer multiple vulnerabilities
Deloitte AI Assist for Customer contained multiple vulnerabilities. In the worst case, a remote, unauthenticated attacker could read or write data to the RAG corpus or make limited modifications to configurations.
first Jul 10, 2026 -
Critical max 9.8
Appriss Insights VINE Application SQL Injection
The Appriss Insights (Equifax) VINE applications allow an unauthenticated attacker to send a specially-crafted request to bypass the login page, access other users' credentials, take over other user accounts, access sensitive PII, and dump other information f…
first Jul 23, 2026 -
High max 8.1ICSA-26-216-01 1 CVE
Acrisure KARR BT and DR-100
Successful exploitation of this vulnerability could allow an attacker to perform unauthorized vehicle control operations.
-
High max 8.4ICSMA-26-216-01 1 CVE
Thermo Fisher Applied Biosystems Genetic Analyzers
Successful exploitation of this vulnerability could allow an attacker to modify .fsa/.hid output files, tampering with DNA data and resulting in inaccurate test results.
-
Medium max 5.7
Watchfire Controller Software
Successful exploitation of this vulnerability could allow a malicious user the ability to deliver malicious firmware that can update and gain full control of the controller.
-
High max 8.4
Schneider Electric IGSS
Schneider Electric is aware of a vulnerability in its IGSS Definition module for the IGSS (Interactive Graphical SCADA System) product. The [IGSS](https://igss.schneider-electric.com/) product is a state-of-the-art SCADA system used for monitoring and control…
first Jul 14, 2026 -
Medium max 4.9ICSA-26-211-01 1 CVE
MikroTik RouterOS
Successful exploitation of this vulnerability could allow an attacker to extract the router's WireGuard private key in plaintext using only low‑privilege API access, enabling full VPN impersonation and decryption of all associated traffic.