SectionVulnerabilities
Patches, advisories and the CVEs behind them.
FUXA SCADA/HMI Flaw Lets Attackers Bypass Auth via Path Tricks
A dot-segment path normalization bug in FUXA versions 1.3.1 and earlier allows unauthenticated remote attackers to enumerate users and roles through the…
CISA Warns of Four Vulnerabilities in Mitsubishi MELSOFT Update Manager
A bundled 7-Zip component in Mitsubishi Electric's MELSOFT Update Manager carries four flaws that could let a local attacker crash the software…
Schneider Electric EcoStruxure IT DCE Patched for XXE Info Disclosure
A medium-severity XXE vulnerability in Schneider Electric's EcoStruxure IT Data Center Expert allows authenticated users to read server-side files via crafted SOAP…
XZ Utils Flaw in B&R Industrial Panels Allows Remote Crash or Memory Corruption
A high-severity race condition in the XZ Utils multithreaded decoder affects eight B&R Industrial Automation panel and controller product lines, with fixes…
Schneider Electric RTUs Expose Credentials via Two High-Severity Flaws
CISA has published an advisory detailing two vulnerabilities in Schneider Electric EasyLogic T150 and Saitel DP remote terminal units that allow credential…
Critical Cursor AI Editor Flaws Enable OS-Level Remote Code Execution
Two vulnerabilities in the Cursor AI code editor, collectively dubbed DuneSlide, allow attackers to escape the IDE sandbox and execute arbitrary code…
Critical Cursor AI Editor Flaws Allow Prompt Injection to Escape Sandbox
Two near-perfect-severity vulnerabilities in the Cursor AI code editor, dubbed DuneSlide, can be triggered by a single malicious prompt to break out…
DHS Confirms Breach of HSIN Sensitive Information-Sharing Platform
An unknown threat actor compromised the Homeland Security Information Network between late May and early June, targeting servers and a SharePoint collaboration…
Opera Adds Paste Protect to Block ClickFix Clipboard Attacks
Opera's new Paste Protect feature intercepts malicious commands before they reach the clipboard, offering browser-level defense against the increasingly popular ClickFix social…
CISA Warns of Auth Bypass and CSRF Flaws in iDirect Satellite Terminals
Two high-severity vulnerabilities in ST Engineering iDirect iQ-Series terminals could expose sensitive satellite credentials and allow unauthenticated denial-of-service attacks. Patches are available…
CISA Warns of Critical Hardcoded Credential Flaw in Gardyn IoT Hub
Three vulnerabilities in Gardyn's IoT Hub platform, including a CVSS 10 hardcoded credential bug, could let unauthenticated attackers access and control connected…
CISA Advisory: CubeSpace Reaction Wheel Vulnerable to Unsigned Firmware Upload
A missing cryptographic signature check in CubeSpace CW0057 Reaction Wheel firmware lets a physically present attacker flash arbitrary firmware. A patch is…