CVE-2026-6889

This CVE ID is rejected/not used and does not represent an active vulnerability entry.

UBUNTU-CVE-2026-63033

A crafted IEC 60870-5-104 I-frame with a declared object count exceedi...

CVE-2026-61893 MZ Automation lib60870 Out-of-bounds Read

A crafted IEC 60870-5-104 I-frame with TypeID 104 CTSNA1 and an inflated object count causes TestCommandgetFromBuffer to read one byte past the end of the heap-allocated message buffer...

CVE-2026-63550

The CVE-2026-63550 issue affects the MMS BER decoder, where a boundary-handling flaw in processing certain fields of confirmed-request messages can cause the decoder to advance its read position incorrectly on receiving a BER-encoded element over an established MMS session (TCP port 102). This ma...

CVE-2026-13584

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, Block-type remo...

CVE-2026-13584

CVE-2026-13584 involves Mitsubishi Electric devices (MELSEC MX MX-R/ MX-F families and related CC-Link IE TSN components) where an attacker with access to a CC-Link IE TSN network can tamper with communication data (control input/output values) by sending specially crafted packets under specific ...

EUVD-2026-51024

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, Block-type remo...

CVE-2026-13584 Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module, Motion Control Board, Block-type remo...

MZ Automation lib60870

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could crash the device being accessed. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Minimize network exposure for all control system devices...

Watchfire Controller Software

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow a malicious user the ability to deliver malicious firmware that can update and gain full control of the controller. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

CVE-2026-64498

A flaw was found in the Linux kernel's Industrial I/O IIO subsystem, specifically within the hardware consumer buffer hw-consumer. Due to an oversight in memory management, a dedicated memory region scanmask was not properly released when its associated buffer was freed. A local attacker with low...

CVE-2026-64496

A flaw was found in the Linux kernel's Industrial I/O IIO event subsystem. A local user can exploit a race condition during the reset of the event FIFO First-In, First-Out buffer. This occurs when another thread accesses a newly allocated file descriptor before the FIFO reset is complete. This ca...

Rockwell Automation ControlLogix, CompactLogix, GuardLogix, and 1756-EN4TR Improper Check for Certificate Revocation (CVE-2026-9636)

The affected products fail to properly reject certificates signed by an intermediate certificate authority that has been revoked via a Certificate Revocation List CRL. A network-based attacker who holds such a certificate can leverage it to establish a Common Industrial Protocol CIP Security...

Rockwell Automation CompactLogix Improper Validation of Integrity Check Value (CVE-2025-11694)

A security issue exists within the affected CompactLogix 5370 controllers due to missing validation of sequence numbers and source IP addresses in the CIP protocol. An attacker can abuse the exposed Connection IDs visible on the controller's web interface to send forged CIP packets, resulting in ...

CVE-2025-21959

creationtimestamp| type| source ---|---|--- 2026-07-28 16:18:01+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2025-21938

creationtimestamp| type| source ---|---|--- 2026-07-28 16:17:59+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2025-21875

creationtimestamp| type| source ---|---|--- 2026-07-28 16:17:44+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-26-209-04...

CVE-2026-14171 ads-tec Industrial IT: Post-login open redirect in the web interface

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...

CVE-2026-14169 ads-tec Industrial IT: Account lockout via non-atomic user creation

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...

CVE-2026-14168

The CVE CVE-2026-14168 affects ads-tec Industrial IT, with a root cause described as missing authorization at the insert path of the configuration table. This allows a low-privileged remote attacker to escalate to administrator privileges, resulting in full system access. The available documents ...