1,062 articles
OT / SCADACISA and Siemens warn of critical CVSS 9.8 flaw in SIMATIC IoT2050 Advanced (ICSA-26-237-03), enabling remote attackers to execute arbitrary code with root privileges.
Threat IntelA critical TOCTOU race condition flaw CVE-2026-87996 in Open WebUI enables attackers to execute DNS rebinding SSRF attacks and harvest cloud metadata and credentials.
MicrosoftMicrosoft discloses critical CVSS 10.0 flaw CVE-2026-69399 in Azure Arc, enabling unauthenticated attackers to exploit confused deputy proxies across hybrid cloud nodes.
Threat IntelA critical integer overflow flaw CVE-2026-86289 in the Ollama GGUF model decoder allows attackers to trigger memory corruption and remote code execution on AI inference clusters.
OT / SCADACISA and Rockwell Automation disclose multiple CIP packet parsing flaws in RSLinx Classic (ICSA-26-244-01), enabling attackers to crash industrial SCADA communication gateways.
Active ExploitAdobe and CISA warn of active exploitation targeting CVE-2026-71362 in Adobe Commerce and Magento, enabling unauthenticated manipulation of checkout orders and customer data.
OT / SCADASiemens fixes critical vulnerabilities in SIMOVE Fleetmanager and SIPLANT, preventing unauthenticated remote threat actors from altering autonomous factory AGV paths.
Threat IntelWSO2 patches critical path traversal flaw CVE-2026-5430 across API Manager and Gateway platforms, preventing unauthenticated remote extraction of master credentials.
OT / SCADACISA ICS advisory ICSA-26-267-02 warns of critical vulnerabilities in Eufy autonomous commercial cleaning robots, allowing remote RTSP stream hijack and LiDAR map exfiltration.
AWS CloudAWS resolves a container boundary escape flaw in Amazon ECS Container Agent that allowed unprivileged containers to intercept task metadata and assume host IAM roles.
OT / SCADACISA ICS advisory ICSA-26-267-01 details critical flaws in Botslab G980H dashcams, allowing remote attackers to intercept live video and hijack fleet telematics.
Threat IntelHPE resolves critical flaw CVE-2026-38291 in Aruba EdgeConnect SD-WAN Orchestrator, allowing unauthenticated remote attackers to bypass auth and execute arbitrary code.
GoogleGoogle Cloud discloses and mitigates a high-severity container escape flaw in GKE node kernels, preventing unprivileged workloads from compromising host nodes.
OT / SCADACISA ICS advisory ICSA-26-265-09 details critical buffer overflow and authentication bypass flaws in OpenPLC Runtime v3, allowing remote process disruption.
GoogleGoogle Cloud resolves a privilege escalation flaw in Compute Engine guest-oslogin that allowed users with compute.osLogin IAM permissions to gain root access.
MicrosoftMicrosoft mitigates maximum-severity CVSS 10.0 flaw CVE-2026-70352 in Azure AI Language Authoring, preventing unauthenticated remote tampering with enterprise AI models.
OT / SCADACISA issues advisory ICSA-26-265-08 for Siemens WTV676 and WTV776 M-Bus gateways, warning of a web interface flaw that terminates building SCADA telemetry.
OT / SCADACISA releases advisory ICSA-26-265-01 for critical CVSS 9.8 flaw CVE-2026-87121 in lwIP MQTT client, allowing unauthenticated attackers to execute arbitrary code.
AWS CloudAWS publishes Bulletin 2026-094-AWS for high-severity flaw CVE-2026-84851 in Amazon Ion-C library, allowing attackers to exhaust stack memory and crash services.
AWS CloudAWS and OpenSearch release bulletin 2026-092-AWS for high-severity flaw CVE-2026-83497 in the SQL plugin allowing authenticated users to execute code via cursors.
MicrosoftMicrosoft discloses high-severity flaw CVE-2026-85917 in Azure AI Foundry allowing unauthenticated attackers to execute SSRF and elevate privileges over the network.
OT / SCADACISA and lwIP maintainers warn of high-severity flaw CVE-2026-91018 in the lwIP TCP/IP stack allowing unauthenticated remote memory corruption across IoT and PLCs.
MicrosoftMicrosoft addresses CVSS 9.6 vulnerability CVE-2026-87701 in Azure Cosmos DB allowing authenticated attackers to execute downstream injection and elevate privileges.
Check PointCheck Point and CISA confirm active in-the-wild exploitation of CVSS 9.8 flaw CVE-2026-93616 allowing unauthenticated attackers to write arbitrary files as root.