Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
498 results · page 1 of 10
Oct 24, 2026A flaw has been found in Scada-LTS 2.8.0.CVE-2026-115803 · Other software · reported by VulDBLow 2.1
A flaw has been found in Scada-LTS 2.8.0. Affected by this vulnerability is the function HttpServletRequest.getParameter of the file AmChartValuesAPI.java of the component AmCharts Data API. Executing a manipulation of the argument ids can lead to authorization bypass. The attack can be executed remotely. The exploit has been published and may be used. The vendor announces: "At this moment we are working on new release with security enhancements which will be introduced to the community soon."
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject CVE-2026-115328 · Other software · riclolsen · reported by VulnCheckHigh 8.7
JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryReadRequest parameters. Attackers can inject stacked statements through NodeId.Id, StartTime, or EndTime values to read, modify, or delete historian data across all locations regardless of role.
- Product
- json-scada
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2026A vulnerability was determined in ScadaBR up to 1.1.CVE-2026-94148 · Other software · reported by VulDBMedium 5.5
A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project.htm of the component Export Project Endpoint. This manipulation causes information disclosure. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.2.0 is recommended to address this issue. Patch name: c852b4988a15bce6011ef169299ad604538f70a9. The affected component should be upgraded. Import path was already gated with Permissions.ensureAdmin(); only export was left unprotected.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispaCVE-2026-84860 · Other software · Scada-LTS · reported by vulnreport@tenable.comHigh 8.8
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authorization Bypass Spring Security gates DWR endpoints by URL path pattern, but DWR itself dispatches method calls based on the POST body parameters c0-scriptName and c0-methodName. The crossDomainSessionSecurity setting in web.xml is set to false, which disables DWR's built-in origin validation. This means any authenticated user can invoke any DWR method (regardless of the URL-based access control) by sending their request to a URL they are permitted to access (e.g. MiscDwr.initializeLongPoll.dwr) while targeting a restricted class in the POST body. This is the systemic root cause that enables multiple other findings to be exploited as a low privilege user.
- Product
- Scada-LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing aCVE-2026-84859 · Other software · Scada-LTS · reported by vulnreport@tenable.comMedium 6.5
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Blind SQL Injection The /api/events/search endpoint accepts a JSON body containing a sortBy array. The values in this array are concatenated directly into the SQL ORDER BY clause without any sanitization or parameterization. This allows authenticated users with the ROLE_USER role to perform time-based and boolean-based blind SQL injection to extract arbitrary data from the database, including password hashes of all users. The endpoint is accessible to any authenticated user with ROLE_USER, ROLE_ADMIN, or ROLE_PUBLIC via POST /api/events/search as defined in spring-security.xml.
- Product
- Scada-LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 16, 2026ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" classCVE-2026-84858 · Other software · Scada-LTS · reported by vulnreport@tenable.comHigh 8.8
ScadaLTS 2.8.1-release-candidate build 0 is affected by an Authenticated Remote Code Execution via Scripting Sandbox Bypass The DWR "DataSourceEditDwr" class exposes the "validateScript" method that compiles and executes attacker-supplied JavaScript via the Rhino scripting engine. There are no authorization checks on this method and so it is possible for an attacker with access to a low privilege user to abuse this flaw by leveraging the DWR routing bypass.
- Product
- Scada-LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem.CVE-2026-82567 · Other software · mySCADA Technologies · reported by ics-cert@hq.dhs.govMedium 5.3
The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is accessible over the network and does not require authentication before accepting a phone number and message from a request and sending the specified SMS message. An unauthenticated attacker with network access to the notification gateway could exploit this vulnerability to send arbitrary SMS messages through the connected modem.
- Product
- mySCADA myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 15, 2026The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions.CVE-2026-73807 · Other software · mySCADA Technologies · reported by ics-cert@hq.dhs.govCritical 9.3
The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the affected API could exploit this vulnerability to access privileged management functions.
- Product
- mySCADA myPRO
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 11, 2026CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionaCVE-2026-81861 · Other software · Schneider Electric · reported by cybersecurity@se.comMedium 5.9
CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality.
- Product
- SCADAPack 47x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 3, 2026A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the CVE-2026-9854 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.5
A vulnerability exists in SYS600 RBAC mechanism where users having access to the engineering tools could elevate their privileges to administrator level on the underlying Windows host, granting themselves full control over the host machine.
- Product
- MicroSCADA SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Sep 3, 2026A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify applicatioCVE-2026-9853 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comHigh 8.5
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify application objects.
- Product
- MicroSCADA SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Sep 3, 2026A CSV injection vulnerability exists in SYS600.CVE-2026-9852 · Other software · Hitachi Energy · reported by cybersecurity@hitachienergy.comMedium 4.6
A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.
- Product
- MicroSCADA SYS600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpublisher.hitachienergy.com
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-67442 · Other software · frangoteam · reported by GitHubLow 2
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-67443 · Other software · frangoteam · reported by GitHubCritical 9.2
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and use it to access the RED.httpAdmin editor and flow deployment API. Because the Node-RED configuration has no second adminAuth gate, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially operating-system commands when nodeRedUnsafeModules is enabled. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-67440 · Other software · frangoteam · reported by GitHubMedium 6.9
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-65985 · Other software · frangoteam · reported by GitHubMedium 6
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. The attacker can use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints, with impact depending on the FUXA host's deployment network. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-65984 · Other software · frangoteam · reported by GitHubHigh 7.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js re-signs inbound JWT claims without validating the current database record. An attacker who possesses a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion. Continued refresh-cookie rotation can extend the stale session and preserve unauthorized access to user management, project manipulation, runtime configuration, scripts, and backdoor-account creation. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47721 · Other software · frangoteam · reported by GitHubMedium 6.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47720 · Other software · frangoteam · reported by GitHubMedium 5.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47719 · Other software · frangoteam · reported by GitHubHigh 8.2
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data reachable from the FUXA host, including when secureEnabled is true. This issue is fixed in version 1.3.2.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2026The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially CVE-2025-7639 · Other software · AVEVA · reported by ics-cert@hq.dhs.govMedium 6.1
The vulnerability, if exploited, could allow an authenticated miscreant with "DNA Authority - Operator" privilege to tamper with serialized data, potentially resulting in code execution during deserialization under the privilege of Enterprise SCADA security group "DNA Apps".
- Product
- AVEVA Enterprise SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47718 · Other software · frangoteam · reported by GitHubMedium 5.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47717 · Other software · frangoteam · reported by GitHubHigh 7.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization.CVE-2026-19657 · Other software · SCADA-LTS · reported by vulnreport@tenable.comMedium 6.1
ScadaLTS 2.7.8.1 reflects user-supplied input into an HTML response without sanitization. An unauthenticated attacker who lures a victim into visiting a crafted URL can execute arbitrary JavaScript in the context of the victim's browser session.
- Product
- ScadaLTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-oCVE-2026-19656 · Other software · SCADA-LTS · reported by vulnreport@tenable.comCritical 9.9
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.
- Product
- ScadaLTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 29, 2026CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiaCVE-2026-0667 · Other software · Schneider Electric · reported by cybersecurity@se.comCritical 9.3
CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when communicating over the Modbus TCP protocol.
- Product
- SCADAPack 47x
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized.CVE-2026-16462 · Other software · Weidmueller Interface · reported by info@cert.vde.comCritical 9.3
In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.
- Product
- PROCON-WEB SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-43947 · Other software · frangoteam · reported by GitHubHigh 8.9
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-43946 · Other software · frangoteam · reported by GitHubHigh 7.7
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-43945 · Other software · frangoteam · reported by GitHubHigh 8.9
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API.CVE-2026-13207 · Other software · Frangoteam · reported by ics-cert@hq.dhs.govHigh 8.7
FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by prefixing paths with dot-segments such as /api/./users, /api/./roles, and /api/project/../users. These requests bypass authentication checks and return sensitive user and role data without credentials.
- Product
- FUXA SCADA/HMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 29, 2026ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistCVE-2026-10058 · Other software · ITP Technology · reported by twcert@cert.org.twMedium 4.8
ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.
- Product
- ITS Intelligent SCADA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 29, 2026ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistCVE-2026-10057 · Other software · ITP Technology · reported by twcert@cert.org.twMedium 4.8
ITS Intelligent SCADA System developed by ITP Technology has a Stored Cross-Site Scripting vulnerability, allowing privileged remote attackers to inject persistent JavaScript codes that are executed in users' browsers upon page load.
- Product
- ITS Intelligent SCADA System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw
May 28, 2026A reflected cross-site scripting issue exists in URL handling.CVE-2026-9646 · Other software · ScadaBR · reported by vulnreport@tenable.comMedium 6.1
A reflected cross-site scripting issue exists in URL handling.
- Product
- ScadaBR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 28, 2026Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server.CVE-2026-9645 · Other software · ScadaBR · reported by vulnreport@tenable.comCritical 9.9
Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.
- Product
- ScadaBR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 22, 2026Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via the decryption fieldCVE-2026-36226 · Other software · reported by MITREMedium 6.1
Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via the decryption field in the Create New Project User component
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.CVE-2026-8605 · Other software · ScadaBR · reported by ics-cert@hq.dhs.govMedium 5.1
In ScadaBR version 1.2.0, a Use of Hard-Coded Credentials vulnerability could allow an attacker to access the SCADA system as admin.
- Product
- ScadaBR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in usCVE-2026-8604 · Other software · ScadaBR · reported by ics-cert@hq.dhs.govHigh 8.6
In ScadaBR version 1.2.0, a CSRF vulnerability could allow an attacker to trigger any authenticated action through a victim's session by luring any logged-in user to a malicious webpage.
- Product
- ScadaBR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.CVE-2026-8603 · Other software · ScadaBR · reported by ics-cert@hq.dhs.govHigh 8.7
In ScadaBR version 1.2.0, an OS Command Injection vulnerability could allow an attacker to execute commands as root on the SCADA system.
- Product
- ScadaBR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2026In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to thCVE-2026-8602 · Other software · ScadaBR · reported by ics-cert@hq.dhs.govHigh 8.8
In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA system and inject arbitrary sensor readings.
- Product
- ScadaBR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 9, 2026AlanWeb SCADA saves sensitive information into a log file.CVE-2026-4901 · Other software · Control System · reported by cvd@cert.plMedium 6.9
AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5
- Product
- AlanWeb SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plcontrol-system.pl
Apr 9, 2026AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters.CVE-2026-34185 · Other software · Control System · reported by cvd@cert.plHigh 8.7
AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in AlanWeb SCADA version 9.8.5
- Product
- AlanWeb SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plcontrol-system.pl
Apr 9, 2026AlanWeb SCADA does not enforce authorization for some directories.CVE-2026-34184 · Other software · Control System · reported by cvd@cert.plHigh 8.8
AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5
- Product
- AlanWeb SCADA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcert.plcontrol-system.pl
Mar 9, 2026ScadaBR 1.12.4 is vulnerable to Session Fixation.CVE-2025-70973 · Other software · Scadabr · reported by MITREMedium 4.8
ScadaBR 1.12.4 is vulnerable to Session Fixation. The application assigns a JSESSIONID session cookie to unauthenticated users and does not regenerate the session identifier after successful authentication. As a result, a session created prior to login becomes authenticated once the victim logs in, allowing an attacker who knows the session ID to hijack an authenticated session.
- Product
- Scadabr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface.CVE-2026-22553 · Other software · InSAT · reported by ics-cert@hq.dhs.govCritical 9.3
All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.
- Product
- MasterSCADA BUK-TS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface.CVE-2026-21410 · Other software · InSAT · reported by ics-cert@hq.dhs.govCritical 9.3
InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution.
- Product
- MasterSCADA BUK-TS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026ScadaApp for iOS 1.1.4.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized buffer in the ServeCVE-2019-25349 · Other software · scadaapp · reported by VulnCheckMedium 4.6
ScadaApp for iOS 1.1.4.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized buffer in the Servername field. Attackers can paste a 257-character buffer during login to trigger an application crash on iOS devices.
- Product
- scadaApp for iOS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordapps.apple.comexploit-db.com
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25951 · Other software · frangoteam · reported by GitHubHigh 8.6
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts. This leads to Remote Code Execution (RCE) when the server reloads the malicious scripts. This vulnerability is fixed in 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25939 · Other software · frangoteam · reported by GitHubCritical 9.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25938 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.