BBCyberAwareby Vikas PanditaLive

Live Feed

Last synced just now · 18/28 sources online

305

Total Items

140

Advisories

41

Critical

60

Exploits

105

Security News

2

GCC High Risk

Showing 140 of 140 Advisories

CVE-2026-96284 | Red Hat Enterprise Linux 7/8/9/10 OCI Code Paths path traversal (EUVD-2026-88046)

problematic , has been found in Red Hat Enterprise Linux 7/8/9/10 . Affected by this vulnerability is an unknown functionality of the component OCI Code Paths . This manipulation causes path traversal. This vulnerability is handled as CVE-2026-96284 . It is possible to launch the attack on the local host. There is not any exploit available.]]>

VulDB Recent1h ago

CVE-2026-96282 | Red Hat Enterprise Linux 7/8/9/10 Flatpak Extension information disclosure (EUVD-2026-88044)

problematic was found in Red Hat Enterprise Linux 7/8/9/10 . Affected is an unknown function of the component Flatpak Extension . The manipulation results in information disclosure. This vulnerability is known as CVE-2026-96282 . It is possible to launch the attack remotely. No exploit is available.]]>

VulDB Recent1h ago

CVE-2026-96283 | Flatpak org.freedesktop.Flatpak.SystemHelper.CancelPull input validation (EUVD-2026-88043)

problematic has been found in Flatpak . This impacts the function org.freedesktop.Flatpak.SystemHelper.CancelPull . The manipulation leads to improper input validation. This vulnerability is traded as CVE-2026-96283 . An attack has to be approached locally. There is no exploit available.]]>

VulDB Recent1h ago

CVE-2026-101087 | NezhaHQ Nezha up to 2.3.2 URL Validator server-side request forgery (EUVD-2026-88022)

critical has been identified in NezhaHQ Nezha up to 2.3.2 . This affects an unknown function of the component URL Validator . Executing a manipulation can lead to server-side request forgery. This vulnerability appears as CVE-2026-101087 . The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.]]>

VulDB Recent2h ago

CVE-2026-96281 | Red Hat Enterprise Linux System Helper RemoveLocalRef privileges management (EUVD-2026-88027)

problematic has been reported in Red Hat Enterprise Linux . The impacted element is the function RemoveLocalRef of the component System Helper . Performing a manipulation results in improper privilege management. This vulnerability is reported as CVE-2026-96281 . The attack requires a local approach. No exploit exists.]]>

VulDB Recent2h ago

CVE-2026-101090 | nezhahq Nezha up to 2.2.3 OAuth2 Redirect Endpoint oauth2.go dashboard_host redirect (EUVD-2026-88025)

problematic has been found in nezhahq Nezha up to 2.2.3 . The affected element is an unknown function of the file cmd/dashboard/controller/oauth2.go of the component OAuth2 Redirect Endpoint . Such manipulation of the argument dashboard_host leads to open redirect. This vulnerability is documented as CVE-2026-101090 . The attack can be executed remotely. There is not any exploit available.]]>

VulDB Recent2h ago

CVE-2026-101088 | NezhaHQ Nezha up to 2.3.0 Service Sentinel Worker servicesentinel.go null pointer dereference (EUVD-2026-88023)

critical has been detected in NezhaHQ Nezha up to 2.3.0 . Impacted is an unknown function of the file service/singleton/servicesentinel.go of the component Service Sentinel Worker . This manipulation causes null pointer dereference. This vulnerability is registered as CVE-2026-101088 . Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.]]>

VulDB Recent2h ago

CVE-2026-101064 | obot-platform Obot up to 0.22.x Remote MCP Server Registration server-side request forgery

problematic has been discovered in obot-platform Obot up to 0.22.x . This issue affects some unknown processing of the component Remote MCP Server Registration . The manipulation results in server-side request forgery. This vulnerability is cataloged as CVE-2026-101064 . The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.]]>

VulDB Recent2h ago

CVE-2026-101085 | nezhahq Nezha up to 2.3.7 Alert Evaluator /api/v1/alert-rule input validation (EUVD-2026-88020)

nezhahq Nezha up to 2.3.7 . It has been rated as problematic . This vulnerability affects unknown code of the file /api/v1/alert-rule of the component Alert Evaluator . The manipulation leads to improper input validation. This vulnerability is listed as CVE-2026-101085 . The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.]]>

VulDB Recent2h ago

CVE-2026-101063 | Obot Platform up to 0.22.x MCP Registry Endpoint improper authentication

Obot Platform Obot up to 0.22.x . It has been declared as problematic . This affects an unknown part of the component MCP Registry Endpoint . Executing a manipulation can lead to improper authentication. This vulnerability is tracked as CVE-2026-101063 . The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.]]>

VulDB Recent2h ago

CVE-2026-101084 | obot-platform Obot up to 0.21.0 MCP Connect Endpoint access control (EUVD-2026-88029)

obot-platform Obot up to 0.21.0 . It has been classified as critical . Affected by this issue is some unknown functionality of the component MCP Connect Endpoint . Performing a manipulation results in improper access controls. This vulnerability is identified as CVE-2026-101084 . The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.]]>

VulDB Recent2h ago

CVE-2026-101062 | obot-platform Obot up to 0.22.x OAuth Dynamic Client Registration improper authentication (EUVD-2026-88033)

obot-platform Obot up to 0.22.x and classified as critical . Affected by this vulnerability is an unknown functionality of the component OAuth Dynamic Client Registration . Such manipulation leads to improper authentication. This vulnerability is referenced as CVE-2026-101062 . It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.]]>

VulDB Recent2h ago

CVE-2026-101089 | nezhahq Nezha up to 2.2.6 Profile Endpoint /api/v1/profile weak password hash (EUVD-2026-88024)

nezhahq Nezha up to 2.2.6 and classified as problematic . Affected is an unknown function of the file /api/v1/profile of the component Profile Endpoint . This manipulation causes password hash with insufficient computational effort. The identification of this vulnerability is CVE-2026-101089 . It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.]]>

VulDB Recent2h ago

CVE-2026-101086 | nezhahq nezha up to 2.3.4 Service Monitor improper authorization (EUVD-2026-88021)

problematic , was found in nezhahq nezha up to 2.3.4 . This impacts an unknown function of the component Service Monitor . The manipulation results in improper authorization. This vulnerability was named CVE-2026-101086 . The attack may be performed from remote. There is no available exploit. You should upgrade the affected component.]]>

VulDB Recent2h ago

CVE-2026-101065 | obot-platform Obot Quickstart OBOT_SERVER_ENABLE_AUTHENTICATION improper authentication (d7e6970 / EUVD-2026-88030)

critical , has been found in obot-platform Obot . This affects an unknown function of the component Quickstart . The manipulation of the argument OBOT_SERVER_ENABLE_AUTHENTICATION leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-101065 . The attack is possible to be carried out remotely. No exploit exists. Applying a patch is the recommended action to fix this issue.]]>

VulDB Recent2h ago

CVE-2026-96280 | Red Hat Enterprise Linux OCI delta stream parser heap-based overflow (EUVD-2026-88015)

very critical was found in Red Hat Enterprise Linux . The impacted element is an unknown function of the component OCI delta stream parser . Executing a manipulation can lead to heap-based buffer overflow. This vulnerability is handled as CVE-2026-96280 . The attack can be executed remotely. There is not any exploit available.]]>

VulDB Recent3h ago

CVE-2026-96279 | Red Hat Enterprise Linux 7/8/9/10 Extraction /etc/shadow information disclosure

problematic has been found in Red Hat Enterprise Linux 7/8/9/10 . The affected element is an unknown function of the file /etc/shadow of the component Extraction . Performing a manipulation results in information disclosure. This vulnerability is known as CVE-2026-96279 . Remote exploitation of the attack is possible. No exploit is available.]]>

VulDB Recent3h ago

CVE-2026-101083 | PMWeb v7.x/v8.x/v2025.x encryptionhelper.dll information disclosure

problematic has been identified in PMWeb v7.x/v8.x/v2025.x . Impacted is an unknown function in the library encryptionhelper.dll . Such manipulation leads to information disclosure. This vulnerability is traded as CVE-2026-101083 . The attack may be launched remotely. There is no exploit available. The vendor was contacted early about this disclosure but did not respond in any way.]]>

VulDB Recent4h ago

CVE-2026-101082 | PMWeb 7.x/8.x/2025.x downloader.aspx FullFileName/FileName path traversal

problematic has been reported in PMWeb 7.x/8.x/2025.x . This issue affects some unknown processing of the file downloader.aspx . This manipulation of the argument FullFileName/FileName causes path traversal. This vulnerability appears as CVE-2026-101082 . The attack may be initiated remotely. In addition, an exploit is available. The vendor was contacted early about this disclosure but did not respond in any way.]]>

VulDB Recent5h ago

CVE-2026-101081 | D-Link DI-8400 16.07 Web Administration Service menu_nat_more.asp menu_nat_more_asp opt stack-based overflow

very critical has been found in D-Link DI-8400 16.07 . This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service . The manipulation of the argument opt results in stack-based buffer overflow. This vulnerability is reported as CVE-2026-101081 . The attack can be launched remotely. Moreover, an exploit is present.]]>

VulDB Recent5h ago

CVE-2026-101080 | Tencent AI-Infra-Guard up to 4.5.2/4.6.2 File Access dir_actions.py startsWith path traversal (Issue 538)

problematic has been detected in Tencent AI-Infra-Guard up to 4.5.2/4.6.2 . This affects the function startsWith of the file skill_scan/tools/dir/dir_actions.py of the component File Access . The manipulation leads to path traversal. This vulnerability is documented as CVE-2026-101080 . The attack needs to be performed locally. Additionally, an exploit exists. You should upgrade the affected component.]]>

VulDB Recent5h ago

CVE-2026-88776 | Citrix ADC/Gateway buffer overflow

critical has been discovered in Citrix ADC and Gateway . Affected by this issue is some unknown functionality. Executing a manipulation can lead to buffer overflow. This vulnerability is registered as CVE-2026-88776 . It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.]]>

VulDB Recent5h ago

CVE-2026-101079 | agentverus agentverus-scanner up to 0.8.1 context.js isSecurityDefenseSkill reliance on untrusted inputs in a security decision (Issue 28)

agentverus agentverus-scanner up to 0.8.1 . It has been rated as problematic . Affected by this vulnerability is the function isSecurityDefenseSkill of the file dist/scanner/analyzers/context.js . Performing a manipulation results in reliance on untrusted inputs in a security decision. This vulnerability is cataloged as CVE-2026-101079 . The attack must be initiated from a local position. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.]]>

VulDB Recent5h ago

CVE-2026-101078 | deepseek-ai deepseek-harness up to 0.1.7-rc.2 Landlock Backend profiles.ts isolation

deepseek-ai deepseek-harness up to 0.1.7-rc.2 . It has been declared as critical . Affected is an unknown function of the file packages/sandbox/sandbox-local/src/profiles.ts of the component Landlock Backend . Such manipulation leads to improper isolation or compartmentalization. This vulnerability is listed as CVE-2026-101078 . The attack must be carried out locally. In addition, an exploit is available. It is advisable to implement a patch to correct this issue. The vendor was contacted early about this disclosure but did not respond in any way.]]>

VulDB Recent5h ago

CVE-2026-101077 | Netcore NR289-GE 1.4.5102 boa_temp process_request missing authentication

Netcore NR289-GE 1.4.5102 . It has been classified as very critical . This impacts the function process_request of the component boa_temp Handler . This manipulation causes missing authentication. This vulnerability is tracked as CVE-2026-101077 . The attack is possible to be carried out remotely. Moreover, an exploit is present. The vendor was contacted early about this disclosure but did not respond in any way.]]>

VulDB Recent5h ago

CRITICAL Exploit in wild

Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway

<p>CISA is amplifying Citrix’s disclosure of eight new vulnerabilities affecting Citrix NetScaler ADC and Citrix NetScaler Gateway products: <a href="https://www.cve.org/CVERecord?id=CVE-2026-88771">CVE-2026-88771</a>, <a href="https://www.cve.org/CVERecord?id=CVE-2026-88772">CVE-2026-88772</a>, <a href="https://www.cve.org/CVERecord?id=CVE-2026-88773">CVE-2026-88773</a>, <a href="https://www.cve.org/CVERecord?id=CVE-2026-88774">CVE-2026-88774</a>, <a href="https://www.cve.org/CVERecord?id=CVE-2026-88775">CVE-2026-88775</a>, <a href="https://www.cve.org/CVERecord?id=CVE-2026-88776">CVE-2026-88

CISA Advisories11h ago

CRITICAL Exploit in wild

CISA Adds Two Known Exploited Vulnerabilities to Catalog

<p class="text-align-justify">CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul type="disc"> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-88771" target="_blank" title="https://www.cve.org/cverecord?id=cve-2026-88771">CVE-2026-88771</a> Citrix NetScaler Improper Input Validation Vulnerability</li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-88772" target="_blank" title="https://www.cve.org/cverecord?id=c

CISA Advisories11h ago

CVE-2026-69522 .NET and Visual Studio Remote Code Execution Vulnerability

Security Updates table updated provide links to the KB articles and download center updates. Microsoft recommends installing the updates.

MSRC Security Update Guide2d ago

CVE-2026-78510 Microsoft Outlook and Word Remote Code Execution Vulnerability

Updated CVE title and CVSS Score. This is an informational change only.

MSRC Security Update Guide2d ago

CVE-2026-85921 Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Updated an acknowledgement. This is an informational change only.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95274: Improper output encoding in DevTools

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95275: Incorrect reference resolution in MediaStream

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95276: Improper input validation in Themes

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95277: Use after free in Views

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95278: Missing authorization in WakeLock

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95279: UI misrepresentation in Omnibox

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95280: Race condition in V8

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95281: Buffer overflow in ANGLE

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95282: Use after free in Platform

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95283: Buffer overflow in Tint

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95284: Buffer overflow in ANGLE

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95285: Missing authorization in WebView

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95286: Type confusion in Bindings

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95287: Missing authorization in Navigation

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95288: UI misrepresentation in Mobile

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95289: Incorrect authorization in Scroll

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

Chromium CVE-2026-95290: Missing authorization in NFC

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2026) for more information.

MSRC Security Update Guide2d ago

CRITICAL Exploit in wild

CISA Adds Two Known Exploited Vulnerabilities to Catalog

<p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-65660" target="_blank">CVE-2026-65660</a> Microsoft SharePoint Code Injection Vulnerability</li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-67279" target="_blank">CVE-2026-67279</a> Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability</li> </ul> <p>These types of vulnerabilities are a fr

CISA Advisories2d ago

CRITICAL Exploit in wild

CISA Adds One Known Exploited Vulnerability to Catalog

<p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-87902 " target="_blank">CVE-2026-87902</a> WordPress Core Remote File Inclusion Vulnerability</li> </ul> <p>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. </p> <p><a href="https://www.cisa.gov/news-events/directives/bod-26-04-impl

CISA Advisories2d ago

Chromium CVE-2026-87612: Type confusion in V8

Information published.

MSRC Security Update Guide2d ago

Chromium CVE-2026-87489: Memory corruption in V8

Information published.

MSRC Security Update Guide2d ago

Chromium CVE-2026-87536: Use after free in V8

Information published.

MSRC Security Update Guide2d ago

Chromium CVE-2026-87625: Use after free in V8

Information published.

MSRC Security Update Guide2d ago

Chromium CVE-2026-87601: Race condition in V8

Information published.

MSRC Security Update Guide2d ago

Eufy Omni C20, Omni X10 Pro

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to run system level commands or execute arbitrary code.</strong></p> <p>The following versions of Eufy Omni C20, Omni X10 Pro are affected:</p> <ul> <li>Omni C20 <1.6.4 (CVE-2026-93289, CVE-2026-93290, CVE-2026-93291)</li> <li>Omni X10 Pro <1.6.4 (CVE-2026-93289)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mo

CISA Advisories3d ago

Botslab G980H Dashcams

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-267-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device operation.</strong></p> <p>The following versions of Botslab G980H Dashcams are affected:</p> <ul> <li>G980H dash cam series 30010_QHG980HN5294SysFW+ (CVE-2026-84399, CVE-2026-82566, CVE-2026-85496, CVE

CISA Advisories3d ago

CRITICAL Exploit in wild

CISA Adds Two Known Exploited Vulnerabilities to Catalog

<p> CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-5430" target="_blank">CVE-2026-5430</a> WSO2 Multiple Products Path Traversal Vulnerability</li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-71362" target="_blank">CVE-2026-71362</a> Adobe Commerce and Magento Incorrect Authorization Vulnerability</li> </ul> <p>These types of vulnerabilities are a frequen

CISA Advisories3d ago

Siemens Mendix Runtime (Update A)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-209-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>This advisory is revoked. Re-investigation confirmed the reported behavior is expected platform configuration and does not expose the protected attribute.</strong></p> <p>The following versions of Siemens Mendix Runtime are affected:</p> <ul> <li>Siemens Mendix Runtime vers:all/* (CVE-2026-7891)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr>

CISA Advisories3d ago

Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators

<h2><strong>Introduction</strong></h2> <p>The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA)—hereafter referred to as the “authoring agencies”—have published this fact sheet to highlight considerations for critical infrastructure entities to reduce risk and minimize vulnerabilities when working with third-party industrial control system (ICS) integrators.</p> <p>ICS is an umbrella term referring to integrated networks of hardware and software designed to monitor and automate physical processes, encompassing specialized control systems and devi

CISA Advisories4d ago

Siemens WTV676 and WTV776

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-08.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>The products listed below contain a denial of service vulnerability that could allow an attacker to force the devices into protection mode under certain conditions. This disables remote connectivity functions (Web Access) to the devices. Siemens has released new versions for the affected products and recommends to update to the latest versions.</strong></p> <p>The following versions of Siemens WTV676 and WTV776 are affected:</p> <

CISA Advisories5d ago

lwIP TCP/IP Stack MQTT Client Application

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to gain full code execution on the device.</strong></p> <p>The following versions of lwIP TCP/IP Stack MQTT Client Application are affected:</p> <ul> <li>MQTT Client Application >=2.0.1|<=2.2.1 (CVE-2026-87121)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr> <th role=

CISA Advisories5d ago

CRITICAL Exploit in wild

CISA Adds Four Known Exploited Vulnerabilities to Catalog

<p>CISA has added four new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-85102" target="_blank">CVE-2026-85102</a> Check Point Multiple Products Improper Certificate Validation Vulnerability</li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-93616">CVE-2026-93616</a> Check Point Multiple Products Path Traversal Vulnerability</li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026

CISA Advisories5d ago

Siemens SIPLUS and SIMATIC Products

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Multiple Siemens products are vulnerable to the "Copy Fail" vulnerability. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.</strong></p> <p>The following versions of Siemens SIPLUS and SIMATIC Products are affected:</p> <ul> <li>SIM

CISA Advisories5d ago

Siemens SIMOVE Fleetmanager and SIPLANT

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-07.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>SIMOVE Fleetmanager and SIPLANT contain a path traversal vulnerability that could allow an attacker to access files outside of intended scope. Siemens has released new versions for the affected products and recommends to update to the latest versions.</strong></p> <p>The following versions of Siemens SIMOVE Fleetmanager and SIPLANT are affected:</p> <ul> <li>SIMOVE Fleetmanager V3.1 vers:intdot/<3.1.13 (CVE-2026-67367)</li> <li

CISA Advisories5d ago

Siemens Desigo CC family

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>A Client Code Execution (CCE) vulnerability has been identified in Desigo CC, potentially allowing malicious actors to execute arbitrary code on client devices through specially crafted graphics documents. This vulnerability leverages user-defined graphics containing embedded scripts that are executed on client application instances. Successful exploitation could lead to compromise of the client operating system and potential late

CISA Advisories5d ago

Siemens Siveillance Control

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>A vulnerability has been identified in the Open Interface Services (OIS) web module affecting Siveillance Control and Siveillance Control Pro (versions OIS 3.x.y and OIS 4.x.y) . This vulnerability allows an attacker to upload arbitrary files, which can lead to unauthorized root-level access on the OIS server. Siemens has released patches and updates for Siveillance OIS to apply to the products that incorporate the OIS service, an

CISA Advisories5d ago

Siemens Industrial Edge Management

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-06.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Industrial Edge Management contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to perform full account takeover by resetting user credentials without completing email verification. Siemens has released new versions for the affected products and recommends to update to the latest versions.</strong></p> <p>The following versions of Siemens Industrial Edge Management are affected:</p> <

CISA Advisories5d ago

lwIP (Lightweight IP)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could result in a system crash, a DoS, or memory corruption, which could lead to code execution on the victim system.</strong></p> <p>The following versions of lwIP (Lightweight IP) are affected:</p> <ul> <li>API >=2.0.1|<=2.2.1 (CVE-2026-91018)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack" data-tablesaw-minimap> <thead> <tr

CISA Advisories5d ago

OpenPLC Runtime v3

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-265-09.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker to hijack session cookies and issue state-changing requests as an operator which would allow the attacker to control the programmable logic controller and the physical processes it drives.</strong></p> <p>The following versions of OpenPLC Runtime v3 are affected:</p> <ul> <li>OpenPLC 3 (CVE-2026-88020)</li> </ul> <div class="csaf-table"> <table class="tablesaw t

CISA Advisories5d ago

CRITICAL Exploit in wild

CISA Adds One Known Exploited Vulnerability to Catalog

<p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-7273" target="_blank">CVE-2026-7273</a> Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability</li> </ul> <p>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise. </p> <p><a href="https://www.cisa.gov/news-events/directiv

CISA Advisories6d ago

CRITICAL Exploit in wild

CISA Adds Two Known Exploited Vulnerabilities to Catalog

<p>CISA has added two new vulnerabilities to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-39964" target="_blank">CVE-2025-39964</a> Linux Kernel Race Condition Vulnerability</li> <li><a href="https://www.cve.org/CVERecord?id=CVE-2026-53266" target="_blank">CVE-2026-53266</a> Linux Kernel Out-of-Bounds Write Vulnerability</li> </ul> <p>These types of vulnerabilities are a frequent attack vector for malicious cy

CISA Advisories9d ago

CRITICAL Exploit in wild

CISA Adds One Known Exploited Vulnerability to Catalog

<p>CISA has added one new vulnerability to its <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">Known Exploited Vulnerabilities (KEV) Catalog</a>, based on evidence of active exploitation.</p> <ul> <li><a href="https://www.cve.org/CVERecord?id=CVE-2025-39682" target="_blank">CVE-2025-39682</a> Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability</li> </ul> <p>This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.</p> <p><a href="https://www.cisa.gov/news-events/dir

CISA Advisories9d ago

Schneider Electric Modicon M340 Controller and Communication Modules

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Schneider Electric is aware of a vulnerability in its Modicon M340</strong><a href="https://www.cisa.gov//www.se.com/ww/en/product-range/1468-modicon-m340-pac/"><strong> https://www.se.com/ww/en/product-range/1468-modicon-m340-pac/</strong></a><strong>, BMXNOR0200H </strong><a href="https://www.se.com/us/en/product/bmxnor0200h/communication-module-modicon-m340-iec-608705101-104-dnp3-for-severe-environments/"><strong>https://www.se

CISA Advisories10d ago

Schneider Electric NetBotz 5 750/755

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-05.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Schneider Electric is aware of multiple vulnerabilities in its NetBotz 5 – 750/755 products.The NetBotz 5 – 750/755 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities. Failure to apply the remediation provided below may risk arbitrary or remote code execution over the local network, which could result in device manipulation and u

CISA Advisories10d ago

Bransys ELD

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow unauthorized access to telemetry data and firmware.</strong></p> <p>The following versions of Bransys ELD are affected:</p> <ul> <li>Android <11.00.00 (CVE-2026-86520, CVE-2026-86689, CVE-2026-77960)</li> <li>iOS <1.1.54 (CVE-2026-86520, CVE-2026-86689, CVE-2026-77960)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="st

CISA Advisories10d ago

Mitsubishi Electric GX Works3 and Motion Control Setting

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow a local attacker to successfully authenticate even with an invalid block password by executing the affected product and modify part of the executable module in memory, and thereby allows the attacker to view, tamper with, destroy, or delete control programs.</strong></p> <p>The following versions of Mitsubishi Electric GX Works3 and Motion Control Setting are affected:</p>

CISA ICS Advisories10d ago

Hitachi Energy FACTS Control Platform (FCP)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Hitachi Energy is aware of vulnerabilities that affect the FACTS Control systems with GWS component listed in this document. An attacker exploiting these vulnerabilities can cause impact on confidentiality, integrity and availability of the product. Following FACTS Control systems with GWS component deployed from year 2020 onwards are likely affected by the above vulnerabilities. Product deployments without GWS component are not a

CISA ICS Advisories10d ago

Mitsubishi Electric CC-Link IE TSN Communication Protocol (Update A)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-211-07.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of this vulnerability could allow an attacker with access to the same network segment to tamper with communication data in the affected product by sending specially crafted packets under specific timing conditions. This could allow the attacker to cause a denial-of-service (DoS) condition in the affected product by interfering with its control function or causing it to operate incorrectly.</strong></p> <p>T

CISA ICS Advisories10d ago

ABB Ability Edgenius

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-06.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>ABB is aware of public reports of a vulnerability CVE‑2026‑31431 (Copy Fail) in the product versions listed as affected in the advisory. An update is available that resolves a publicly reported vulnerability. CVE‑2026‑31431 (Copy Fail) is a Linux kernel vulnerability that may allow a locally authenticated user or compromised container workload to gain elevated (root) privileges on affected systems. Once root access is obtained, th

CISA ICS Advisories10d ago

Schneider Electric PowerChute Serial Shutdown

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-260-07.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Schneider Electric is aware of vulnerabilities in its PowerChute Serial Shutdown product. The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktops, servers and workstations. Failure to apply the remediation provided below may risk improper authentication validation which could result in disruption of operations and access to system data.</

CISA ICS Advisories10d ago

Siemens Mendix SAML

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-06.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Mendix SAML module contains a vulnerability that could allow unauthenticated remote attackers to hijack an account in specific SSO configurations. Mendix has provided fix releases for the Mendix SAML module and recommends to update to the latest version.</strong></p> <p>The following versions of Siemens Mendix SAML are affected:</p> <ul> <li>Mendix SAML (Mendix 10 compatible) vers:intdot/<4.2.3 (CVE-2026-80465)</li> <li>Mendix

CISA ICS Advisories12d ago

Digital Watchdog VMAX DVR and NVR Product Lineups

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-01.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could grant full administrative control of the device, allowing an attacker to view live and recorded surveillance, alter device configurations, and use the device as a network pivot point.</strong></p> <p>The following versions of Digital Watchdog VMAX DVR and NVR Product Lineups are affected:</p> <ul> <li>VMAX A1 G4 DVRs vers:all/* (CVE-2026-68953, CVE-2026-66890, CVE-2026-68070,

CISA ICS Advisories12d ago

Wärtsilä FOS-Onboard (Update A)

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-02.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to deliver an unauthorized update, execute code, or extract credentials to allow the attacker to impersonate a privileged client.</strong></p> <p>The following versions of Wärtsilä FOS-Onboard (Update A) are affected:</p> <ul> <li>FOS-Onboard 5.07.0923.01 (CVE-2026-78225, CVE-2026-81855)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stac

CISA ICS Advisories12d ago

mySCADA myPRO Manager

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-03.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Successful exploitation of these vulnerabilities could allow an attacker to access privileged management functions or send arbitrary SMS messages through the connected GSM modem.</strong></p> <p>The following versions of mySCADA myPRO Manager are affected:</p> <ul> <li>mySCADA myPRO Manager <=2.1 (CVE-2026-73807, CVE-2026-82567)</li> </ul> <div class="csaf-table"> <table class="tablesaw tablesaw-stack" data-tablesaw-mode="stack

CISA ICS Advisories12d ago

Schneider Electric SCADAPack x70 Products

<p><a href="https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-258-04.json"><strong>View CSAF</strong></a></p> <h2>Summary</h2> <p><strong>Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Failure to apply the mitigations provided below may increase the risk of unauthorized access to RTU configuration through the Secure Lock functionality, potential

CISA ICS Advisories12d ago

China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI Companies

<h2><strong>Executive summary</strong></h2> <p>China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy. While “distillation” is recognized as a legitimate and useful technique in AI research, China-based AI companies are engaging in aggressive, malicious, and targeted distillation activities at an industrial scale that extract restricted proprietary funct

US-CERT Alerts23d ago

A Tale of Two SOCs: Insights From Two Red Team Assessments

<h2><strong>Advisory at a Glance</strong></h2> <table> <tbody> <tr> <th>Title</th> <td>A Tale of Two SOCs: Insights From Two Red Team Assessments</td> </tr> <tr> <th>Original Publication </th> <td><strong>August 25, 2026</strong></td> </tr> <tr> <th>Executive Summary</th> <td> <p>The Cybersecurity and Infrastructure Security Agency (CISA) conducted simultaneous red team assessments at two organizations and observed different defensive outcomes. In both environments, the red team achieved full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organizatio

US-CERT Alerts2026-08-20

Defending Against an Active Threat to Siemens S7 Series PLCs

<h2><strong>Executive summary</strong></h2> <p><em><strong>Note:</strong> This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.</em></p> <p><strong>Top Mitigations</strong></p> <ul type="disc"> <li><strong>Inventory </strong>all Siemens S7 S

US-CERT Alerts2026-08-14

#StopRansomware: Gunra Ransomware

<h2><strong>Advisory at a Glance</strong></h2> <table> <tbody> <tr> <th>Title</th> <td>#StopRansomware: Gunra Ransomware</td> </tr> <tr> <th>Original Publication</th> <td>August 10, 2026</td> </tr> <tr> <th>Executive Summary</th> <td>Gunra is a ransomware-as-a-service (RaaS) used by affiliates to target government, critical infrastructure, and other organizations. The Gunra ransomware variant first appeared in 2025 and expanded to RaaS operations in 2026. The actors leverage a double-extortion model, both encrypting data and threatening to publish exfiltrated data to a dedicated leak site (DLS

US-CERT Alerts2026-08-05

Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite

<div class="c-page-title__buttons"><a class="c-button" href="https://media.defense.gov/2026/Jul/22/2003965244/-1/-1/1/CSA_RUSSIA_PHISHING_TARGET_ZIMBRA.PDF">Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite</a></div> <h2><strong>Executive summary</strong> </h2> <p>A group of Russian state-supported cyber actors has been targeting and compromising various Western government and commercial organizations using the Zimbra Collaboration Suite (ZCS) software since at least July 2025. The Russian state-supported advanced persistent threa

US-CERT Alerts2026-07-21

Improve Router Hygiene to Protect Against Russian State-Sponsored Targeting

<p>Russian Government-Sponsored Activity Targets Poorly Configured and Vulnerable Devices Across Critical Sectors</p> <h2><strong>Executive summary</strong></h2> <p>Russian Federal Security Service (FSB) Center 16 cyber actors continue to exploit poorly configured and vulnerable networking devices worldwide, opportunistically compromising multiple critical infrastructure sector networks. This joint Cybersecurity Advisory (CSA) builds on FBI’s <a href="https://www.ic3.gov/PSA/2025/PSA250820" target="_blank">Russian Government Cyber Actors Targeting Networking Devices, Critical Infrastructure</a

US-CERT Alerts2026-07-08

Defending Against China-Nexus Covert Networks of Compromised Devices

<div class="SCXW131754345 BCX8"> <div class="OutlineElement Ltr SCXW131754345 BCX8"> <h2><a class="c-button c-button--on-dark" href="https://urldefense.us/v3/__https://www.ncsc.gov.uk/news/defending-against-china-nexus-covert-networks-of-compromised-devices__;!!BClRuOV5cvtbuNI!Cvg8stIR3jHWVZgHhCVvEwbwDXxXIRSprOQ9JtY2YKwxUIGVovuDAu7QrFsfw3sfAVd8-gxEMIpgldwlY-jTD7G0%24">Defending against china-nexus covert networks of compromised devices</a></h2> <h2><a class="c-button c-button--on-dark" href="https://urldefense.us/v3/__https://www.ncsc.gov.uk/news/executive-summary-defending-against-china-nexus

US-CERT Alerts2026-04-21

Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

<h2><strong>Advisory at a Glance</strong></h2> <table> <tbody> <tr> <th>Title</th> <td>Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure</td> </tr> <tr> <th>Original Publication</th> <td><strong>April 7, 2026</strong></td> </tr> <tr> <th>Last Update </th> <td><strong>July 22, 2026</strong></td> </tr> <tr> <th>Executive Summary</th> <td>The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers

US-CERT Alerts2026-04-06

Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure

<h2><strong>Summary</strong></h2> <p><strong>Note:</strong> This joint Cybersecurity Advisory is being published as an addition to the Cybersecurity and Infrastructure Security Agency (CISA) May 6, 2025, joint fact sheet <a href="https://www.cisa.gov/resources-tools/resources/primary-mitigations-reduce-cyber-threats-operational-technology" title="Primary Mitigations to Reduce Cyber Threats to Operational Technology">Primary Mitigations to Reduce Cyber Threats to Operational Technology</a> and European Cybercrime Centre’s (EC3) <a href="https://www.europol.europa.eu/media-press/newsroom/news/gl

US-CERT Alerts2025-12-05

CISA Shares Lessons Learned from an Incident Response Engagement

<h2><strong>Advisory at a Glance</strong></h2> <table> <tbody> <tr> <td>Executive Summary</td> <td>CISA began incident response efforts at a U.S. federal civilian executive branch (FCEB) agency following the detection of potential malicious activity identified through security alerts generated by the agency’s endpoint detection and response (EDR) tool. CISA identified three lessons learned from the engagement that illuminate how to effectively mitigate risk, prepare for, and respond to incidents: vulnerabilities were not promptly remediated, the agency did not test or exercise their incident r

US-CERT Alerts2025-09-22

Impact of AI on cyber threat from now to 2027

An NCSC assessment highlighting the impacts on cyber threat from AI developments between now and 2027.

NCSC UK2025-05-07

A method to assess 'forgivable' vs 'unforgivable' vulnerabilities

Research from the NCSC designed to eradicate vulnerability classes and make the top-level mitigations easier to implement.

NCSC UK2025-01-28

The near-term impact of AI on the cyber threat

An NCSC assessment focusing on how AI will impact the efficacy of cyber operations and the implications for the cyber threat over the next two years.

NCSC UK2024-01-24

ACD - The Sixth Year

Key findings and full report from the 6th year of the Active Cyber Defence (ACD) programme.

NCSC UK2023-07-06

Cyber Threat Report: UK Legal Sector

An updated report from the NCSC explaining how UK law firms - of all sizes - can protect themselves from common cyber threats.

NCSC UK2023-06-22

The threat from commercial cyber proliferation

Report informing readers about the threat to UK industry and society from commercial cyber tools and services.

NCSC UK2023-04-19

Organisational use of Enterprise Connected Devices

Assessing the cyber security threat to UK organisations using Enterprise Connected Devices.

NCSC UK2022-05-10

ACD - The Fifth Year

Key findings from the 5th year of the Active Cyber Defence (ACD) programme.

NCSC UK2022-05-10

Threat report on application stores

This report outlines the risks associated with the use of official and third party app stores.

NCSC UK2022-05-04

Malware analysis report on SparrowDoor malware

A technical analysis of a new variant of the SparrowDoor malware.

NCSC UK2022-04-25

Vendor Security Assessment

Assessing the security of network equipment.

NCSC UK2022-03-22

Decrypting diversity: Diversity and inclusion in cyber security report 2021

The 2nd joint report between the NCSC and KPMG UK benchmarks against the 2020 findings to gauge what progress has been made.

NCSC UK2021-11-23

Active Cyber Defence (ACD) - the fourth year

The year four report covers 2020 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.

NCSC UK2021-05-10

Active Cyber Defence (ACD) - The Third Year

The year three report covers 2019 and aims to highlight the achievements and efforts made by the Active Cyber Defence programme.

NCSC UK2021-02-19

Technical report: Responsible use of the Border Gateway Protocol (BGP) for ISP interworking

Technical report on best practice use of this fundamental data routing protocol.

NCSC UK2021-01-20

Decrypting diversity: Diversity and inclusion in cyber security report 2020

Joint report between the NCSC and KPMG UK is the first in a series to benchmark and track levels of diversity and inclusion in the cyber security industry.

NCSC UK2020-07-28

The cyber threat to sports organisations

The NCSC report highlights the cyber threats faced by the sports sector and suggests how to stop or lessen their impact on organisations.

NCSC UK2020-07-23

Summary of the NCSC analysis of May 2020 US sanction

A summary of the NCSC’s analysis of the May 2020 US sanction which caused the NCSC to modify the scope of its security mitigation strategy for Huawei.

NCSC UK2020-07-14

High level privacy and security design for NHS COVID-19 contact tracing app

NCSC technical paper about the privacy and security design of the NHS contact tracing app developed to help slow the spread of coronavirus.

NCSC UK2020-05-04

Summary of NCSC’s security analysis for the UK telecoms sector

A summary of the NCSC’s security analysis for the UK telecoms sector

NCSC UK2020-01-28

CVE-1999-1415 — Vulnerability in /usr/bin/mail in DEC ULTRIX before 4.2 allows local users to gain privileges.

Vulnerability in /usr/bin/mail in DEC ULTRIX before 4.2 allows local users to gain privileges.

NVD (NIST)1991-08-23

CVE-1999-1034 — Vulnerability in login in AT&T System V Release 4 allows local users to gain privileges.

Vulnerability in login in AT&T System V Release 4 allows local users to gain privileges.

NVD (NIST)1991-05-23

CVE-1999-1123 — The installation of Sun Source (sunsrc) tapes allows local users to gain root privileges via setuid root programs (1) ma

The installation of Sun Source (sunsrc) tapes allows local users to gain root privileges via setuid root programs (1) makeinstall or (2) winstall.

NVD (NIST)1991-05-20

CVE-1999-1193 — The "me" user in NeXT NeXTstep 2.1 and earlier has wheel group privileges, which could allow the me user to use the su c

The "me" user in NeXT NeXTstep 2.1 and earlier has wheel group privileges, which could allow the me user to use the su command to become root.

NVD (NIST)1991-05-14

CVE-1999-1194 — chroot in Digital Ultrix 4.1 and 4.0 is insecurely installed, which allows local users to gain privileges.

chroot in Digital Ultrix 4.1 and 4.0 is insecurely installed, which allows local users to gain privileges.

NVD (NIST)1991-05-01

CVE-1999-1211 — Vulnerability in in.telnetd in SunOS 4.1.1 and earlier allows local users to gain root privileges.

Vulnerability in in.telnetd in SunOS 4.1.1 and earlier allows local users to gain root privileges.

NVD (NIST)1991-03-27

CVE-1999-1212 — Vulnerability in in.rlogind in SunOS 4.0.3 and 4.0.3c allows local users to gain root privileges.

Vulnerability in in.rlogind in SunOS 4.0.3 and 4.0.3c allows local users to gain root privileges.

NVD (NIST)1991-03-27

CVE-1999-1438 — Vulnerability in /bin/mail in SunOS 4.1.1 and earlier allows local users to gain root privileges via certain command lin

Vulnerability in /bin/mail in SunOS 4.1.1 and earlier allows local users to gain root privileges via certain command line arguments.

NVD (NIST)1991-02-22

CVE-1999-1258 — rpc.pwdauthd in SunOS 4.1.1 and earlier does not properly prevent remote access to the daemon, which allows remote attac

rpc.pwdauthd in SunOS 4.1.1 and earlier does not properly prevent remote access to the daemon, which allows remote attackers to obtain sensitive system information.

NVD (NIST)1991-01-15

CVE-1999-1115 — Vulnerability in the /etc/suid_exec program in HP Apollo Domain/OS sr10.2 and sr10.3 beta, related to the Korn Shell (ks

Vulnerability in the /etc/suid_exec program in HP Apollo Domain/OS sr10.2 and sr10.3 beta, related to the Korn Shell (ksh).

NVD (NIST)1990-12-31

CVE-1999-1197 — TIOCCONS in SunOS 4.1.1 does not properly check the permissions of a user who tries to redirect console output and input

TIOCCONS in SunOS 4.1.1 does not properly check the permissions of a user who tries to redirect console output and input, which could allow a local user to gain privileges.

NVD (NIST)1990-12-20

CVE-1999-1554 — /usr/sbin/Mail on SGI IRIX 3.3 and 3.3.1 does not properly set the group ID to the group ID of the user who started Mail

/usr/sbin/Mail on SGI IRIX 3.3 and 3.3.1 does not properly set the group ID to the group ID of the user who started Mail, which allows local users to read the mail of other users.

NVD (NIST)1990-10-31

CVE-1999-1057 — VMS 4.0 through 5.3 allows local users to gain privileges via the ANALYZE/PROCESS_DUMP dcl command.

VMS 4.0 through 5.3 allows local users to gain privileges via the ANALYZE/PROCESS_DUMP dcl command.

NVD (NIST)1990-10-25

CVE-1999-1198 — BuildDisk program on NeXT systems before 2.0 does not prompt users for the root password, which allows local users to ga

BuildDisk program on NeXT systems before 2.0 does not prompt users for the root password, which allows local users to gain root privileges.

NVD (NIST)1990-10-03

CVE-1999-1391 — Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges via a combina

Vulnerability in NeXT 1.0a and 1.0 with publicly accessible printers allows local users to gain privileges via a combination of the npd program and weak directory permissions.

NVD (NIST)1990-10-03

CVE-1999-1392 — Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges.

Vulnerability in restore0.9 installation script in NeXT 1.0a and 1.0 allows local users to gain root privileges.

NVD (NIST)1990-10-03

CVE-1999-0209 — The SunView (SunTools) selection_svc facility allows remote users to read files.

The SunView (SunTools) selection_svc facility allows remote users to read files.

NVD (NIST)1990-08-14

CVE-2000-0388 — Buffer overflow in FreeBSD libmytinfo library allows local users to execute commands via a long TERMCAP environmental va

Buffer overflow in FreeBSD libmytinfo library allows local users to execute commands via a long TERMCAP environmental variable.

NVD (NIST)1990-05-09

CVE-1999-0084 — Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID t

Certain NFS servers allow users to use mknod to gain privileges by creating a writable kmem device and setting the UID to 0.

NVD (NIST)1990-05-01

CVE-1999-1506 — Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up to 4.0.3, allows remote attackers to access user bin.

Vulnerability in SMI Sendmail 4.0 and earlier, on SunOS up to 4.0.3, allows remote attackers to access user bin.

NVD (NIST)1990-01-29

CVE-1999-1467 — Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary commands as root, po

Vulnerability in rcp on SunOS 4.0.x allows remote attackers from trusted hosts to execute arbitrary commands as root, possibly related to the configuration of the nobody user.

NVD (NIST)1989-10-26

CVE-1999-1122 — Vulnerability in restore in SunOS 4.0.3 and earlier allows local users to gain privileges.

Vulnerability in restore in SunOS 4.0.3 and earlier allows local users to gain privileges.

NVD (NIST)1989-07-26

CVE-1999-1471 — Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by s

Buffer overflow in passwd in BSD based operating systems 4.3 and earlier allows local users to gain root privileges by specifying a long shell or GECOS field.

NVD (NIST)1989-01-01

CVE-1999-0082 — CWD ~root command in ftpd allows root access.

CWD ~root command in ftpd allows root access.

NVD (NIST)1988-11-11

CVE-1999-0095 — The debug command in Sendmail is enabled, allowing attackers to execute commands as root.

The debug command in Sendmail is enabled, allowing attackers to execute commands as root.

NVD (NIST)1988-10-01