https://vulnogram.org/ Most recent CVEs assigned by Cybersecurity and Infrastructure Security Agency (CISA) Industrial Control Systems (ICS) (icscert). https://vulnogram.org/seaview/icons/icscert.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-105960 https://vulnogram.org/CVE-2026-105960 PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy. The driver uses a requested or queued record count without sufficiently capping the copy to the actual caller-supplied output length. Medium Tue, 20 Oct 2026 20:28:12 GMT https://vulnogram.org/CVE-2026-110322 https://vulnogram.org/CVE-2026-110322 The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before dereferencing fixed fields during post-processing. Medium Tue, 20 Oct 2026 20:26:21 GMT https://vulnogram.org/CVE-2026-103672 https://vulnogram.org/CVE-2026-103672 The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then copies attacker payload from record+0x1c into a fixed-size stack destination. High Tue, 20 Oct 2026 20:23:18 GMT https://vulnogram.org/CVE-2026-101103 https://vulnogram.org/CVE-2026-101103 The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold the output record. Medium Tue, 20 Oct 2026 20:19:10 GMT https://vulnogram.org/CVE-2026-109576 https://vulnogram.org/CVE-2026-109576 The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list advanced its processed-bytes counter even when a record had been rejected as invalid. Medium Tue, 20 Oct 2026 20:16:18 GMT https://vulnogram.org/CVE-2026-107777 https://vulnogram.org/CVE-2026-107777 Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account. High Fri, 16 Oct 2026 14:40:20 GMT https://vulnogram.org/CVE-2026-105667 https://vulnogram.org/CVE-2026-105667 In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive'… High Network Exploitable Fri, 16 Oct 2026 14:32:22 GMT https://vulnogram.org/CVE-2026-105279 https://vulnogram.org/CVE-2026-105279 In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated… Critical Network Exploitable Fri, 16 Oct 2026 14:30:51 GMT https://vulnogram.org/CVE-2026-101021 https://vulnogram.org/CVE-2026-101021 MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and repeated copying. High Network Exploitable Fri, 16 Oct 2026 14:28:54 GMT https://vulnogram.org/CVE-2026-105273 https://vulnogram.org/CVE-2026-105273 MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input. High Network Exploitable Fri, 16 Oct 2026 14:21:12 GMT https://vulnogram.org/CVE-2026-107621 https://vulnogram.org/CVE-2026-107621 JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream. High Network Exploitable Fri, 16 Oct 2026 14:19:32 GMT https://vulnogram.org/CVE-2026-97851 https://vulnogram.org/CVE-2026-97851 The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage… Critical Network Exploitable Fri, 16 Oct 2026 14:16:55 GMT https://vulnogram.org/CVE-2026-105664 https://vulnogram.org/CVE-2026-105664 The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid a… Medium Network Exploitable Fri, 16 Oct 2026 14:06:55 GMT https://vulnogram.org/CVE-2026-97858 https://vulnogram.org/CVE-2026-97858 An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full… Medium Network Exploitable Fri, 16 Oct 2026 14:04:47 GMT https://vulnogram.org/CVE-2026-107617 https://vulnogram.org/CVE-2026-107617 An attacker can use a hard-coded credential to log in to EseeCloud devices. Critical Network Exploitable Fri, 16 Oct 2026 14:02:54 GMT https://vulnogram.org/CVE-2026-92817 https://vulnogram.org/CVE-2026-92817 The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level pr… High Tue, 13 Oct 2026 23:22:43 GMT https://vulnogram.org/CVE-2026-107607 https://vulnogram.org/CVE-2026-107607 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to access a real-time video stream without authentication. Medium Tue, 13 Oct 2026 18:19:47 GMT https://vulnogram.org/CVE-2026-107606 https://vulnogram.org/CVE-2026-107606 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to retrieve a snapshot of the live feed without authentication. Medium Tue, 13 Oct 2026 18:19:01 GMT https://vulnogram.org/CVE-2026-107605 https://vulnogram.org/CVE-2026-107605 SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on the local network to view live video feed without authentication. Medium Tue, 13 Oct 2026 18:17:17 GMT https://vulnogram.org/CVE-2026-15340 https://vulnogram.org/CVE-2026-15340 lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow. Critical Network Exploitable Fri, 09 Oct 2026 14:52:43 GMT https://vulnogram.org/CVE-2026-33272 https://vulnogram.org/CVE-2026-33272 A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they… Medium Fri, 09 Oct 2026 14:44:26 GMT https://vulnogram.org/CVE-2026-39453 https://vulnogram.org/CVE-2026-39453 Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots. High Fri, 09 Oct 2026 14:42:18 GMT https://vulnogram.org/CVE-2026-29797 https://vulnogram.org/CVE-2026-29797 No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authen… High Fri, 09 Oct 2026 14:40:20 GMT https://vulnogram.org/CVE-2026-33367 https://vulnogram.org/CVE-2026-33367 SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication. Critical Fri, 09 Oct 2026 14:38:37 GMT https://vulnogram.org/CVE-2026-28745 https://vulnogram.org/CVE-2026-28745 Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system. Critical Network Exploitable Fri, 09 Oct 2026 14:36:22 GMT https://vulnogram.org/CVE-2026-39460 https://vulnogram.org/CVE-2026-39460 Usernames and passwords, including the default factory credentials, are stored in plaintext within the configuration file. With administrator rights, the configuration file can be viewed through the CLI or they can be exported from the device through… Critical Fri, 09 Oct 2026 14:30:47 GMT https://vulnogram.org/CVE-2026-32645 https://vulnogram.org/CVE-2026-32645 Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. Critical Fri, 09 Oct 2026 14:24:05 GMT https://vulnogram.org/CVE-2026-105278 https://vulnogram.org/CVE-2026-105278 The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full administrative cont… Critical Network Exploitable Fri, 09 Oct 2026 14:01:21 GMT https://vulnogram.org/CVE-2026-104629 https://vulnogram.org/CVE-2026-104629 A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can… High Fri, 09 Oct 2026 13:58:21 GMT https://vulnogram.org/CVE-2026-101022 https://vulnogram.org/CVE-2026-101022 A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, reve… Medium Fri, 09 Oct 2026 13:55:29 GMT https://vulnogram.org/CVE-2026-85479 https://vulnogram.org/CVE-2026-85479 The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it. Medium Network Exploitable Fri, 09 Oct 2026 13:52:01 GMT https://vulnogram.org/CVE-2026-105281 https://vulnogram.org/CVE-2026-105281 The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the… High Network Exploitable Fri, 09 Oct 2026 13:49:06 GMT https://vulnogram.org/CVE-2026-100730 https://vulnogram.org/CVE-2026-100730 A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authenticati… Critical Network Exploitable Fri, 09 Oct 2026 13:44:39 GMT https://vulnogram.org/CVE-2026-105269 https://vulnogram.org/CVE-2026-105269 Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploi… High Thu, 08 Oct 2026 21:29:11 GMT https://vulnogram.org/CVE-2026-104628 https://vulnogram.org/CVE-2026-104628 Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with Viewer privileges could submit crafted search input that causes excessive processing, potentially degrading th… High Thu, 08 Oct 2026 21:24:25 GMT https://vulnogram.org/CVE-2026-105275 https://vulnogram.org/CVE-2026-105275 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable appl… Medium Thu, 08 Oct 2026 21:18:29 GMT https://vulnogram.org/CVE-2026-101024 https://vulnogram.org/CVE-2026-101024 Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to… High Thu, 08 Oct 2026 21:07:08 GMT https://vulnogram.org/CVE-2026-107334 https://vulnogram.org/CVE-2026-107334 Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent… Medium Thu, 08 Oct 2026 17:32:00 GMT https://vulnogram.org/CVE-2026-107335 https://vulnogram.org/CVE-2026-107335 Malcolm's upload-processing pipeline (scripts/safe-extract.py) enforces entry-count, nesting-depth, and total-uncompressed-byte limits when extracting container archives (zip/tar/rar/7z via libarchive), but those limits are not applied when the uploa… Medium Thu, 08 Oct 2026 17:30:12 GMT https://vulnogram.org/CVE-2026-107337 https://vulnogram.org/CVE-2026-107337 The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including contro… High Thu, 08 Oct 2026 17:28:23 GMT https://vulnogram.org/CVE-2026-107361 https://vulnogram.org/CVE-2026-107361 The Arkime live capture service (arkime-live) in Malcolm runs with network_mode: host, exposing port 8005 on all network interfaces (viewHost=0.0.0.0). Arkime trusts the X-Forwarded-User header from any IP address (userAuthIps=::,0.0.0.0/0) and auto-… Medium Thu, 08 Oct 2026 17:27:03 GMT https://vulnogram.org/CVE-2026-107362 https://vulnogram.org/CVE-2026-107362 Malcolm file-upload component ships the upstream FilePond PHP server (pqina/filepond-server-php) largely unmodified: Dockerfile copies all upstream *.php files and Malcolm only overwrites config.php and submit.php. Upstream index.php exposes a fetch… High Thu, 08 Oct 2026 17:25:23 GMT https://vulnogram.org/CVE-2026-107333 https://vulnogram.org/CVE-2026-107333 Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control (RBAC) authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatte… High Thu, 08 Oct 2026 17:23:14 GMT https://vulnogram.org/CVE-2026-107336 https://vulnogram.org/CVE-2026-107336 Malcolm's front nginx reverse proxy defines a "Dashboards → Arkime shortcut" location using a case-insensitive regex matcher but a case-sensitive rewrite. A request whose path segment is not exact-lowercase (for example /IDDASH2ARK/...) enters the lo… Medium Network Exploitable Thu, 08 Oct 2026 17:20:46 GMT https://vulnogram.org/CVE-2026-84411 https://vulnogram.org/CVE-2026-84411 The web management service in affected RouterOS versions contains an integer underflow in its HTTP request body handling that is reachable before authentication. This can be leveraged by an unauthenticated network attacker to achieve arbitrary code e… Critical Network Exploitable Fri, 02 Oct 2026 22:09:48 GMT https://vulnogram.org/CVE-2026-94591 https://vulnogram.org/CVE-2026-94591 Armatura One stores database and message-broker credentials in an install configuration file, encrypting them with AES-128-CBC when this protection is enabled. The encryption key and initialization vector are fixed values embedded in the software its… High Fri, 02 Oct 2026 21:54:42 GMT https://vulnogram.org/CVE-2026-94592 https://vulnogram.org/CVE-2026-94592 Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating s… High Fri, 02 Oct 2026 21:52:54 GMT https://vulnogram.org/CVE-2026-94593 https://vulnogram.org/CVE-2026-94593 Armatura One's backup and restore routine records the full database connection command, including the superuser password, in plain text in a log file on the host. Credentials disclosed by this finding can be used to access the database when access to… High Fri, 02 Oct 2026 21:51:00 GMT https://vulnogram.org/CVE-2026-94594 https://vulnogram.org/CVE-2026-94594 Armatura One's message broker logs client connection credentials and the associated password in plain text during normal operation. Any party with read access to this log, or to a backup or support bundle that includes it, can obtain the logged crede… Medium Fri, 02 Oct 2026 21:48:14 GMT https://vulnogram.org/CVE-2026-95102 https://vulnogram.org/CVE-2026-95102 WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that… Critical Network Exploitable Fri, 02 Oct 2026 21:34:37 GMT