Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-50516 Microsoft veřejná správa telekomunikace finance výroba a průmysl US
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to access sensitive information on the device. The following versions of Johnson Controls Inc. TL280 are affected: TL280 <5.63 (CVE-2026-27871) CVSS Vendor Equipment Vulnerabilities v3 4.1 Johnson Controls Inc. Johnson Controls Inc. TL280 Use of a Broken or Risky Cryptographic Algorithm Background Critical Infrastructure Sectors: Critical Manufacturing, Commercial Facilities, Government Services and…
EPSS 0.00 CVSS 4.1 CVE-2026-27871 Johnson Controls energetika výroba a průmysl veřejná správa doprava US
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to bypass security, crash systems, execute unauthorized actions, or compromise data. The following versions of ABB Ability Zenon are affected: IIoT services with MongoDB (4.2) installed on ABB Ability Zenon vers:all/* CVSS Vendor Equipment Vulnerabilities v3 7.8 ABB ABB Ability Zenon Improper Handling of Length Parameter Inconsistency, Improper Neutralization of Null Byte or NUL Character, Collapse of Data…
KEV ✓ EPSS 0.83 CVSS 7.8 CVE-2020-7921 CVE-2020-7928 CVE-2025-14847 ABB energetika zdravotnictví vodárenství výroba a průmysl US
[PPSA-2026-003] The Linux kernel used in the IndustrialPI, 'linux-image-revpi-v8', prior to version 6.12.91-revpi0-rpi-v8 contains multiple vulnerabilities. Successful exploitation of these vulnerabilities can give an attacker full control over the device.
KEV ✓ EPSS 0.98 CVE-2026-31431 CVE-2026-43284 CVE-2026-46300 Pilz výroba a průmysl DE
Společnost Siemens vydala bezpečnostní aktualizace pro systém Desigo CC. Opravy řeší kritickou zranitelnost (CVSS 9.8), jejíž zneužití může umožnit vzdálené spuštění kódu nebo způsobit nedostupnost systému. Zranitelnost se týká organizací využívajících systém Siemens Desigo CC pro řízení budov (Building Management System - BMS). Provozovatelům se doporučuje co nejdříve nainstalovat dostupné bezpečnostní aktualizace a zajistit, aby systémy nebyly přímo dostupné z internetu, ale byly chráněny…
CVSS 9.8 Siemens energetika výroba a průmysl CZ
This vulnerability allows local attackers to escalate privileges on affected installations of Phoenix Contact CHARX SEC-3150 devices. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-44106.
EPSS 0.00 CVSS 7.8 CVE-2026-44106 Phoenix Contact výroba a průmysl US
This vulnerability allows network-adjacent attackers to create a denial-of-service condition on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.5. The following CVEs are assigned: CVE-2026-44090.
EPSS 0.01 CVSS 6.5 CVE-2026-44090 Phoenix Contact výroba a průmysl energetika US
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Phoenix Contact CHARX SEC-3150 devices. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-44099.
EPSS 0.00 CVSS 7.5 CVE-2026-44099 Phoenix Contact výroba a průmysl US
SQL Injection in Frappe's ERPNext Wed, 07/29/2026 - 12:41 Aviso Affected Resources ERPNext: versions prior to 15.111.0 and 16.22.0. Description INCIBE has coordinated the disclosure of a high-severity vulnerability affecting Frappe's ERPNext, an enterprise resource planning system. The vulnerability was discovered by Alejandro Ramos.This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:CVE-2026-12895: CVSS v4.0: 7.1| CVSS AV:N/AC…
EPSS 0.00 CVSS 7.1 CVE-2026-12895 Frappe výroba a průmysl ES
[VDE-2026-077] The affected products belong to the Controller or Servo Drive product family and contain a vulnerability in a security-critical activation mechanism for service access. The signature verification of a file used for SSH activation can be compromised, which could allow unauthorized access to the device.
EPSS 0.00 CVE-2026-14837 Lenze výroba a průmysl DE
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-12390.
EPSS 0.00 CVSS 7.8 CVE-2026-12390 AzeoTech výroba a průmysl US
This vulnerability allows remote attackers to execute arbitrary code on affected installations of AzeoTech DAQFactory. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-12921.
EPSS 0.00 CVSS 7.8 CVE-2026-12921 AzeoTech výroba a průmysl US
TrendAI™ Research breaks down what changed in CISA’s updated advisory on an ongoing PLC exploitation, why this activity might be more dangerous than a similar campaign in 2023, and how organizations can take action now to protect themselves.
For the latest discoveries in cyber research for the week of 20th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Ernst & Young, a global accounting and professional services company, has disclosed a data breach involving a compromised third-party IT support platform. The exposed support tickets may have contained client documents, tax information, employee details, and other sensitive information submitted while requesting technical assistance. Jscrambler, a…
KEV ✓ · ransomware EPSS 0.12 CVE-2026-15409 CVE-2026-15410 CVE-2026-56155 CVE-2026-56164 CVE-2026-60137 CVE-2026-63030 Microsoft WordPress SonicWall výroba a průmysl finance IL
A technical analysis of three chained zero-day vulnerabilities in Siemens ROX II OT switches that allow privilege escalation and persistent root access. The post Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy appeared first on Unit 42.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Rockwell Automation Arena Simulation. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-6071.
EPSS 0.01 CVSS 7.8 CVE-2026-6071 Rockwell Automation výroba a průmysl US
This vulnerability allows local attackers to escalate privileges on affected installations of Fuji Electric Tellus. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-8108.
EPSS 0.00 CVSS 7.8 CVE-2026-8108 Fuji Electric výroba a průmysl US
Many manufacturing plants depend on OT systems that stay in service for many years. That long run can hide significant cybersecurity risks.
Path Traversal vulnerability (CVE-2026-8464) has been found in Golem OEE MES software.
EPSS 0.00 CVE-2026-8464 Golem výroba a průmysl PL
Summary A vulnerability has been identified in Trac d.o.o. Process Database Manager (PDBM). The application contains a hard‑coded cryptographic secret embedded directly within the executable binary. This secret is used by the product’s internal encryption and decryption routines, including the mechanism responsible for decrypting credentials stored in the application’s configuration file. An attacker with local high privileges on the host system may extract the hard‑coded secret from the…
EPSS 0.00 CVSS 6.4 CVE-2026-25600 Trac energetika výroba a průmysl SI
[PPSA-2026-002] The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by malicious web requests.
EPSS 0.00 CVE-2018-25193 Pilz výroba a průmysl DE
Written by: Jamie Collier, Robin Grunewald Germany has reclaimed its position as a primary focus for cyber extortion in Europe. While data leak site (DLS) posts rose almost 50% globally in 2025, Google Threat Intelligence (GTI) data shows that the surge is hitting German infrastructure harder and faster than its regional neighbors, marking a significant return to the high-pressure levels previously observed in the country during 2022 and 2023. Cyber Criminals Pivoting Back to Germany Germany…
A Nemzetbiztonsági Szakszolgálat Nemzeti Kiberbiztonsági Intézet (NBSZ NKI) riasztást ad ki egy kritikus infrastruktúrákat célzó, jelenleg is aktív támadási kampány kapcsán. A rendelkezésre álló elemzés szerint a kampány során iráni kötődésű szereplők ipari vezérlőrendszerekhez, ezen belül Rockwell Automation / Allen-Bradley PLC-khez fértek hozzá, és azok manipulálásával működési zavarokat idéztek elő. A támadások sajátossága, hogy nem […]
Rockwell Automation energetika výroba a průmysl vodárenství HU
JPCERT/CC held the ICS Security Conference 2026 on February 10, 2026. This conference aims to share the current threat landscape surrounding Industrial Control System (ICS) in Japan and abroad, as well as initiatives undertaken by stakeholders in ICS security. It also seeks to help participants strengthen their security measures and establish best practices. Since its launch in 2009, the conference has been held annually, and this year marked the 18th conference. This year’s conference was held…
CERT Polska has received a report about 3 vulnerabilities (CVE-2026-4901, CVE-2026-34184, CVE-2026-34185) found in AlanWeb SCADA software.
EPSS 0.00 CVE-2026-34184 CVE-2026-34185 CVE-2026-4901 AlanWeb energetika výroba a průmysl vodárenství PL
Explore the latest manufacturing cybersecurity trends, from ransomware to OT takeovers, and real-world risks to production. Learn how to secure your plant.