⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to extract the router's WireGuard private key in plaintext using only low‑privilege API access, enabling full VPN impersonation and decryption of all associated traffic.
This CISA advisory highlights multiple vulnerabilities in Johnson Controls OpenBlue Employee (FMS Employee) software. The flaws include unrestricted file upload, stored cross-site scripting, and HTML injection, which could allow an attacker to upload malicious files or execute script-based attacks.
Schneider Electric disclosed a vulnerability in its IGSS Definition module for the IGSS SCADA system. An out-of-bounds write flaw exists when importing a malicious CGF file, risking data loss or arbitrary code execution.
This advisory from CISA describes a vulnerability in Watchfire Controller Software, identified as CVE-2026-5846. The issue stems from hard-coded RSA private keys and X.509 certificates used for HTTPS/TLS, which could enable an attacker to gain full control of the controller.
A security issue exists in Rockwell Automation CompactLogix 5380, ControlLogix 5580, and EN4TR communication modules related to CIP Security certificate revocation handling. The controller fails to properly reject certificates signed by an intermediate certificate that has been revoked via a CRL, potentially allowing a network-based attacker to establish an untrusted connection and cause a denial-of-service condition.
CISA disclosed multiple vulnerabilities in o6 Automation's open62541 OPC UA implementation, including integer underflow, overflow, and use-after-free flaws. Successful exploitation could lead to sensitive information disclosure, denial of service, or arbitrary code execution.