⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
A denial-of-service vulnerability (CVE-2026-59693) in Siemens Desigo DXR and PXC controllers allows an attacker to send malformed BACnet packets, causing devices to stop responding. Affected firmware versions require a reset or reboot for recovery.
AVEVA Enterprise SCADA contains a deserialization of untrusted data vulnerability in multiple versions from 2021 through 2025 and HMI releases. An authenticated Operator can tamper with serialized data, potentially causing code execution as DNA Apps during deserialization.
Siemens Solid Edge contains multiple file parsing vulnerabilities affecting PAR, PSM, and DFT formats. Attackers can lure users into opening malicious files to crash the process or execute code.
Multiple vulnerabilities in ANDRITZ HIPASE-250 and 250 SCALA (versions <=7.20) include reversible password storage (CVE-2026-65309), missing authentication (CVE-2026-65310), and hardcoded credentials (CVE-2026-65311, 65313). An attacker can exploit these to read device data or gain access to affected workstations.
An undocumented hard-coded credential (CVE-2026-18164) in Flow Neuroscience FL-100 and Halo Neuroscience FL-100 devices permits Bluetooth attackers to manipulate brain stimulation parameters and override safety limits. All firmware versions before July 2026 are affected.
Haiwell IoT Cloud HMI Gateway version 3.40.1.12 is vulnerable to OS command injection in the Net Check feature accessed through /setting. The cmdPing Socket.io event passes unsanitized input to the OS, allowing remote attackers to execute commands as root.