Security advisories
Plain-English explanations of named CVEs affecting industrial, medical and IoT devices, each one sourced to NVD, CISA KEV and FIRST EPSS so you can check the evidence behind the score. Every entry lists affected components, versions and the vendor’s own advisory. Not a vulnerability feed for your products — see firmware security for that.
163 results
CVE-2026-20349
CVE-2026-20349: Cisco Secure Firewall ASA/FTD Remote Access VPN DoS (KEV)
Cisco Secure Firewall ASA Software
CVE-2026-22769
CVE-2026-22769: Dell RecoverPoint for VMs Hard-Coded Credential RCE
Dell RecoverPoint for Virtual Machines (RP4VMs)
CVE-2026-24858
CVE-2026-24858: Fortinet FortiCloud SSO Cross-Device Authentication Bypass (KEV, Exploited)
Fortinet FortiOS
CVE-2026-25108
CVE-2026-25108: Soliton Systems FileZen OS Command Injection (KEV)
Soliton Systems FileZen
CVE-2026-25994
CVE-2026-25994: PJSIP PJNATH ICE Session Buffer Overflow via Long ICE Usernames
PJSIP / PJNATH (ICE session credential handling)
CVE-2026-34909
CVE-2026-34909: Ubiquiti UniFi OS Path Traversal (KEV, CVSS 10.0)
Ubiquiti UniFi OS (Cloud Gateways, Dream Machine family, UNVR, UNAS, UniFi Express, UniFi OS Server)
CVE-2026-3503
CVE-2026-3503: wolfSSL Post-Quantum Crypto Fault Injection on ARM Cortex-M
wolfSSL (wolfCrypt)
CVE-2026-3611
CVE-2026-3611: Honeywell IQ4 Series BMS Controller Auth Bypass
Honeywell IQ4E / IQ412 / IQ422 / IQ4NC / IQ41x BMS Controllers
CVE-2026-46300
CVE-2026-46300: Linux Kernel skb_try_coalesce() Shared-Fragment Flaw
Linux Kernel
CVE-2026-46728
CVE-2026-46728: Das U-Boot FIT Image Signature Verification Bypass via Hashed-Nodes Omission
Das U-Boot (DENX Software Engineering) bootloader, FIT configuration signature verification
CVE-2026-50751
CVE-2026-50751: Check Point Security Gateway IKEv1 Auth Bypass (KEV)
Check Point Quantum Security Gateway (Gaia OS)
CVE-2026-58704
CVE-2026-58704: Google Pixel Cellular Modem Privilege Escalation (KEV)
Google Pixel devices (cellular modem component)
CVE-2026-60007
CVE-2026-60007: Eclipse Milo OPC UA Padding-Oracle Credential Theft
Eclipse Milo (OPC UA SDK)
CVE-2026-62927
CVE-2026-62927: Eclipse Milo OPC UA Authorization Bypass
Eclipse Milo
CVE-2026-65130
CVE-2026-65130: NVIDIA Infrastructure Controller OS Command Injection
NVIDIA Infrastructure Controller
CVE-2026-6653
CVE-2026-6653: Hitachi Energy RTU500 libxml2 Use-After-Free
Hitachi Energy RTU500 series CMU Firmware
CVE-2026-67277
CVE-2026-67277: MikroTik RouterOS Bandwidth-Test Kernel Memory Disclosure
MikroTik RouterOS
CVE-2026-67279
CVE-2026-67279: MikroTik RouterOS SSH Auth Bypass (KEV)
MikroTik RouterOS
CVE-2026-6866
CVE-2026-6866: Schneider EcoStruxure Panel Server Creds
Schneider Electric EcoStruxure Panel Server
CVE-2026-7273
CVE-2026-7273: Zyxel GS1900 Switch CGI Buffer Overflow RCE
Zyxel GS1900-8
CVE-2026-7473
CVE-2026-7473: Arista EOS Tunnel Decapsulation Spoofing (KEV)
Arista EOS (7020R, 7280R/R2/R3, 7500R/R2/R3, 7800R3 series switches with VXLAN, decap-groups or GRE tunnel decapsulation configured)
CVE-2026-76418
CVE-2026-76418: Cisco Secure Firewall ASA/FTD SSL VPN Reload DoS (KEV, Exploited)
Cisco Secure Firewall Adaptive Security Appliance (ASA) Software
CVE-2026-76460
CVE-2026-76460: Cisco Identity Services Engine Authentication Bypass (KEV)
Cisco Identity Services Engine (ISE) / ISE-PIC
CVE-2026-76461
CVE-2026-76461: Cisco Secure Email Gateway SQL Injection to Root RCE (KEV)
Cisco Secure Email Gateway (AsyncOS)
Fix guides for the weakness classes behind these CVEs
Each advisory links to the guide for its weakness class. The guides show device and firmware teams how to detect, fix, verify and disclose that class across a product line, not one CVE at a time.
How to fix authentication bypass in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose authentication bypass and missing authentication (CWE-287/CWE-306 and related CWEs) in embedded products, sourced to MITRE CWE.
Updated
How to fix command injection in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose OS command injection (CWE-77/CWE-78) in embedded products, sourced to MITRE CWE and OWASP.
Updated
How to fix hard-coded credentials in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose hard-coded passwords and keys (CWE-798/CWE-259) in embedded products, sourced to MITRE CWE and CISA.
Updated
How to fix SQL injection, XSS, resource exhaustion and deserialization flaws in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose SQL injection (CWE-89), cross-site scripting (CWE-79), resource exhaustion (CWE-400) and insecure deserialization (CWE-502) in embedded web UIs and management APIs, sourced to MITRE CWE and OWASP.
Updated
How to fix memory corruption in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose memory-corruption bugs (CWE-787/CWE-120 and related out-of-bounds, overflow and use-after-free CWEs) in embedded products, sourced to MITRE CWE and CISA.
Updated
How to fix path traversal in embedded firmware
Practical steps for device and firmware teams to detect, fix, verify and disclose path traversal (CWE-22 and related CWEs) in embedded web UIs and file-handling code, sourced to MITRE CWE.
Updated
How to fix weak cryptography in embedded firmware
Practical steps for device and firmware teams to detect, fix and verify broken ciphers, inadequate key strength, hard-coded keys and weak random number generation (CWE-327/326/321/330) in embedded products, sourced to MITRE CWE and CISA.
Updated
Firmware vulnerabilities & fixes
OWASP Firmware Security Testing Methodology (FSTM), explained
OWASP's nine-stage Firmware Security Testing Methodology (FSTM) — obtaining and extracting firmware, static and dynamic analysis, emulation and exploitation — plus how it fits with OWASP's ISTG and ISVS.
Updated
Find out which of these CVEs are in your products or plant
Device firmware security: find the problems, then fix them
Firmware scan, SBOM and vulnerability report for device makers and brands, with optional remediation, maintenance and monitoring.
OT Snapshot: see what is really on your shop-floor network
Record shop-floor traffic from a mirror port, upload it, and receive a device inventory, vulnerabilities and a map of remote access.
Questions about this page?