4,100 results · Feed
-
Low max 4.8ICSA-26-211-02 3 CVEs
Johnson Controls OpenBlue Employee
Successful exploitation of these vulnerabilities could allow an attacker to upload malicious files, execute stored cross-site scripting attacks, or inject arbitrary HTML content.
-
High max 8.8ICSA-26-211-03 1 CVE
Toptech Systems RCU II+ and Multiload II+
Successful exploitation of this vulnerability could allow an attacker to gain full system control and misuse it to access or manipulate connected networks and resources.
-
Medium max 8.2ICSA-26-211-05 1 CVE
Rockwell Automation CompactLogix 5380 ControlLogix 5580 / 1756-EN4TR Communications Module
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
-
High max 7.5ICSA-26-211-06 1 CVE
NASA Core Flight System (cFS) Health & Safety (HS) Application
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
-
High max 8.8ICSA-26-211-08 4 CVEs
o6 Automation open62541
Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, cause a denial of service, or potentially execute arbitrary code.
-
High max 7.5ICSA-26-211-10 8 CVEs
MZ Automation GmbH libiec61850
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition on the device.
-
Medium max 6.5ICSA-26-211-11 2 CVEs
MZ Automation lib60870
Successful exploitation of these vulnerabilities could crash the device being accessed.
-
High max 7.3
Hardy Barth Salia EV Charge Controller (Update A)
Successful exploitation of these vulnerabilities could crash the device being accessed; a buffer overflow condition may allow remote code execution.
first Apr 21, 2026 -
Critical max 8.8
Siemens Desigo CC
OpenSSL has published a stack based buffer overflow vulnerability that allows a remote attacker to cause a denial of service (DoS) or potentially allow for remote code execution. Siemens has released new versions for several affected products and recommends t…
first Jul 14, 2026 -
High max 7.4
Siemens SIMATIC S7-PLCSIM Advanced
SIMATIC S7-PLCSIM Advanced contains a vulnerability that could allow an attacker to cause a denial of service condition. Siemens is preparing fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.
first Jul 14, 2026 -
Critical max 10.0
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP
Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.6 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant). Siemens is preparing fix versions and recommends specific countermeasure…
first Jul 14, 2026 -
Medium max 6.4
ABB KNX Update Tool
ABB has been contacted by a researcher who identified a vulnerability in one of its products. ABB has been contacted by a researcher who identified a vulnerability in one of its products. The vulnerability report has been shared in responsible disclosure. An …
first Jul 17, 2026 -
High max 8.8ICSA-26-209-05 1 CVE
MikroTik RouterOS and Cloud Hosted Router
Successful exploitation of this vulnerability could allow attackers to rapidly guess passwords and gain unauthorized system access.
-
Medium max 5.3ICSA-26-209-06 1 CVE
igloohome Smart Lock Mobile Application
Successful exploitation of this vulnerability could allow an unauthorized actor to access functions or backend services.
-
High max 8.8VA-26-204-02 1 CVE
DHIS2 SQL Injection in SqlView Filter Parameter Leading to Arbitrary Database Read
A SQL injection vulnerability was identified in the SqlView API endpoint of the DHIS2 application in the `filter` parameter used by the `/api/sqlViews/{viewId}/data.json` endpoint. An authenticated user with access to a SqlView can inject arbitrary SQL querie…
-
High max 7.2
Rockwell Automation ThinManager
Successful exploitation of this vulnerability could allow an authenticated attacker to write arbitrary files to restricted system directories outside of the application's intended directory.
first Jul 14, 2026 -
Low max 4.8ICSA-26-204-02 1 CVE
Johnson Controls XAAP Android
Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device.
-
High max 8.8ICSA-26-204-03 4 CVEs
Weintek cMT3092X
Successful exploitation of these vulnerabilities could allow a non-privileged user to escalate privileges or view the credentials of other users.
-
Critical max 10.0ICSA-26-204-04 5 CVEs
Panduit IntraVUE
Successful exploitation of these vulnerabilities could allow an attacker with access to the IT network to manipulate industrial control devices without requiring physical access, specialized insider knowledge, or advanced tooling.
-
High max 8.1ICSA-26-204-06 4 CVEs
MZ Automation libIEC61850
Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions.
-
High max 8.2ICSA-26-204-07 1 CVE
MZ Automation lib60870
Successful exploitation of this vulnerability could cause the parsing process to crash, which will cause a denial of service.
-
High max 7.3VA-26-202-03 1 CVE
FileGator privilege escalation
FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod()' function through 'octdec()' conversion, with no validation. This allows an authenticated user with 'chmod' permission…
-
Medium max 5.3VA-26-202-02 1 CVE
Trezor Safe improper security check in on-device display
Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign_tx / sign_tx_eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed cal…
-
Medium max 7.6
Cloudflare Universal SSL CAA record override
Cloudflare Universal SSL automatically manages the CAA RRset for customer zones in order to issue and renew TLS certificates. In affected Universal SSL configurations, Cloudflare authoritative DNS can serve an auto-managed CAA RRset at query time that superse…
first Jul 2, 2026 -
High max 7.3VA-26-202-01 1 CVE
ASUS AURA SYNC driver local privilege escalation
Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation.
-
High max 5.7
Siemens RUGGEDCOM APE1808 with Palo Alto Networks Virtual NGFW
Palo Alto Networks has published [1] information on vulnerabilities in PAN-OS. This advisory lists the related Siemens Industrial products affected by these vulnerabilities. Customers are advised to consult and implement the workarounds provided in Palo Alto …
first Jul 14, 2026 -
Critical max 10.0
Siemens Opcenter X
Opcenter X before V2604 contain an authentication bypass vulnerability that could allow an attacker to gain full unauthorized access to the application. Siemens has released a new version for Opcenter X and recommends to update to the latest version.
first Jul 14, 2026 -
Critical max 9.8
Siemens SIDIS Secured SmartPlug
SIDIS Secured SmartPlug before V7.26.0310 is affected by multiple vulnerabilities in the components OpenSSL, OpenSSH, and several other packages as described below. Siemens has released a new version of SIDIS Secured SmartPlug and recommends to update to the …
first Jul 14, 2026 -
Medium max 6.7
Siemens IAM Client
Multiple Siemens products are affected by unquoted search path vulnerability in IAM Client. This could allow an authenticated local attacker to perform privilege escalation. Siemens has released new versions for several affected products and recommends to upd…
first Jul 14, 2026 -
Critical max 9.8
Siemens CADRA
CADRA is affected by multiple zlib and Foxit vulnerabilities. Siemens has released a new version for CADRA and recommends to update to the latest version. Siemens is preparing further fix versions and recommends specific countermeasures for products where fix…
first Jul 14, 2026 -
High max 8.8ICSA-26-202-07 1 CVE
Rockwell Automation FactoryTalk Services Platform
Successful exploitation of this vulnerability could allow an attacker to impersonate an authorized user on the FTSP server, resulting in unauthorized access to system configurations.
-
High max 8.7ICSA-26-202-08 1 CVE
Rockwell Automation 1718-AENTR/1719-AENTR
Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product.
-
High max 7.3ICSA-26-202-10 3 CVEs
Rockwell Automation Studio 5000 Logix Designer
Successful exploitation of these vulnerabilities could allow for a local attacker to execute arbitrary files, alter configurations, or execute arbitrary code.
-
Medium max 6.4VA-26-197-01 1 CVE
remorses/genql code injection
remorses/genql before version 6.3.4 allows an authenticated attacker with control of the GraphQL schema that is passed to genql to inject arbitrary JavaScript or TypeScript. The malicious code is injected into the generated schema.ts file and executes when th…
-
High max 7.0ICSA-26-197-01 4 CVEs
Rockwell Automation Arena
Successful exploitation these vulnerabilities could allow an attacker to execute arbitrary code in the context of the current process.
-
High max 8.7ICSA-26-197-02 1 CVE
Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
-
High max 7.5ICSA-26-197-03 1 CVE
NASA Core Flight System (cFS) Health & Safety (HS) Application
Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.
-
High max 7.0ICSA-26-197-04 6 CVEs
AutomationDirect Productivity Suite
Successful exploitation of these vulnerabilities could allow an attacker with local or physical access to cause memory corruption, unintended information disclosure, application instability, or a denial-of-service condition in the affected product.
-
High max 9.2ICSA-26-197-06 3 CVEs
Rockwell Automation CompactLogix, ControlLogix, Compact GuardLogix and GuardLogix
Successful exploitation of these vulnerabilities could allow an attacker to cause a denial-of-service condition.
-
Medium max 6.5ICSA-26-197-07 1 CVE
SALTO ProAccess Space
Successful exploitation of this vulnerability allows an authenticated attacker to escalate privileges and access spaces outside their assigned partition, within the same Salto ProAccess Space installation or system. Exploitation requires valid authenticated o…