Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
3692advisories found
csaf_wagogmbhcokghigh · 7.8
vde-2025-081
WAGO PLCs and communication components running firmware versions below 4.10.0 (FW32 and 70) are affected by multiple CODESYS Control vulnerabilities. An unauthenticated remote attacker could cause denial-of-service conditions that disrupt industrial control operations, and a local user opening a manipulated CODESYS project file could trigger arbitrary code execution in the user context, compromising system integrity, confidentiality and availability. The advisory does not state a numeric severity score; remediation is to update to firmware 4.10.0 (FW32) or higher.
fkie_nvdhigh · 7.8
fkie_cve-2026-58925
The android.hardware.automotive.evs-default HAL service contains a heap use-after-free vulnerability caused by unsynchronized access to an std::unordered_map. An unprivileged application with access to the EVS manager can trigger this use-after-free by making concurrent calls to setExtendedInfo and getExtendedInfo, potentially enabling code execution within the privileged HAL process. This is an automotive component, so the issue directly affects vehicle systems that use this EVS HAL service.
cvelistv5high · 7.8
cve-2026-114148
Incorrect default permissions in ASP.NET Core allow an authorized attacker to elevate privileges locally on affected Microsoft .NET 8.0, 9.0, 10.0 and 11.0 installations on Linux, macOS and Windows, as well as Microsoft .NET source-build Linux tarballs and Microsoft-published ASP.NET Core runtime and targeting-pack Linux tarballs. This could be relevant where ASP.NET Core is deployed in automotive systems, since an attacker with existing authorized access could gain higher privileges on the host. The advisory does not state a severity rating. Confirm applicability through the product SBOM or dependency inventory.
csaf_microsofthigh · 7.8
msrc_cve-2026-89472
The advisory covers a Linux kernel change in the power supply charger-manager subsystem that registers regulators before exposing sysfs, but it does not state a specific vulnerability, attacker capability, or severity. This could be relevant where charger-manager is deployed in automotive or embedded systems, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.8
rhsa-2026:86633
A flaw in the sudo utility allows a local authenticated user to bypass time-based sudoers restrictions (NOTBEFORE/NOTAFTER rules whose timestamps omit the trailing Z) by setting the TZ environment variable to an extreme offset, shifting the authorization window by up to about 25 hours so expired rules are treated as valid; authentication itself is not bypassed, only the time-based authorization check, and exploitation requires a non-default sudoers configuration. Red Hat rates this Important, and sudo is shipped in RHEL 7 through RHEL 10 and RHIVOS. This could be relevant where sudo is deployed in automotive systems, such as Linux-based ECUs, telematics units or build infrastructure; confirm applicability through the product SBOM or dependency inventory.
csaf_abbhigh · 7.8
7paa026271
ABB Ability Edgenius versions 3.2.3.0 and below contain a critical vulnerability in the Edge AuthDB component, which stores authorization information for the platform. An attacker with local Linux access to an affected node could modify authentication database records without using the API, potentially affecting user access controls, dependent edge services, and overall platform integrity, or making the node unavailable. ABB has released a corrective update and states it has no reports of the vulnerability being exploited.
fkie_nvdhigh · 7.8
fkie_cve-2026-19676
The advisory describes a flaw in the user-mode verifier for the peci_transfer() system call in Zephyr's PECI driver code, where caller-supplied buffer pointers and lengths inside the message structure were passed unchecked to in-tree PECI drivers. A user-mode thread holding the PECI device could exploit this to write hardware-supplied bytes into kernel memory, push kernel memory contents onto the PECI/eSPI bus, or trigger a supervisor-mode fault, amounting to a full user-mode-to-kernel escape with arbitrary kernel read and write primitives; exploitation requires CONFIG_USERSPACE, one of the listed PECI drivers, and local code execution in a user-mode thread with the PECI device. This could be relevant where Zephyr PECI drivers are deployed in automotive or embedded systems, since PECI is used for processor thermal and management signaling, but the advisory does not confirm any specific automotive product is affected. Confirm applicability through the product SBOM or dependency inventory.
csaf_pilzgmbhcokghigh · 7.8
ppsa-2026-004
Pilz's IndustrialPI industrial PC uses a piControl kernel module that, before version 2.8.0-1, contains multiple vulnerabilities. An authenticated user who can run their own code on the device could exploit these flaws to corrupt kernel memory and cause a denial of service. The advisory does not state a numeric severity rating; it recommends updating the picontrol package to version 2.8.0-1 or higher and running only trusted code on the device.
csaf_redhathigh · 7.8
rhsa-2026:83797
Red Hat rates this Linux kernel flaw as Important: a local user could trigger a use-after-free in POSIX timer handling during a failed program startup, causing a system crash and denial of service, or potentially privilege escalation. The affected component is the Linux kernel shipped for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. This could be relevant where the Linux kernel is deployed in automotive systems, such as in-vehicle infotainment, telematics, or gateway controllers; confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.8
rhsa-2026:83775
Red Hat has released an Important-rated security update for the Linux kernel addressing a flaw where a local user could trigger a use-after-free condition, causing a system crash and denial of service or potential privilege escalation. The kernel is a core component that may be used in automotive systems, so this could be relevant where the Linux kernel is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.8
rhsa-2026:83738
Red Hat has released an Important-rated security update for the Linux kernel addressing a flaw where a local user could trigger a use-after-free condition, causing a system crash and denial of service or potential privilege escalation. The kernel is a core component that may be used in embedded and automotive systems, so this could be relevant where the Linux kernel is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.8
rhsa-2026:83739
Red Hat has released an Important-rated security update for the kernel-rt package, the Real Time Linux Kernel used in Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. The flaw is a use-after-free in the Linux kernel involving POSIX timers during program execution, which a local user could exploit to crash the system (Denial of Service) or potentially escalate privileges. This could be relevant where the real-time kernel is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
csaf_microsofthigh · 7.8
msrc_cve-2026-98156
The advisory describes a change in the Linux kernel's drm/virtio driver to use the DMA API for resource backing on Xen, affecting the virtio GPU component. The advisory does not state a specific attacker capability or impact, and no severity rating is provided. This could be relevant where the virtio GPU component is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
fkie_nvdhigh · 7.8
fkie_cve-2026-105035
The EnergizeLab FirmwareUpdater for AArch64 uses one hard-coded AES key shared across all installations, so an attacker who recovers that key could decrypt and forge firmware packages for any device trusting it. This could be relevant where this updater is deployed in automotive systems, since forged firmware could be accepted by those devices. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.8
cve-2026-85915
A heap-based buffer overflow in the Windows PCI Bus Driver lets an authorized attacker elevate privileges locally on affected Microsoft Windows 10, Windows 11, and Windows Server systems. This could be relevant where Windows-based systems are deployed in automotive environments, such as engineering workstations, diagnostic tools, or in-vehicle compute platforms. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.8
rhsa-2026:82326
Red Hat has released an Important-rated kernel live patch update for Red Hat Enterprise Linux 10 addressing memory-safety flaws in the Linux kernel, including a use-after-free in the RDMA/mlx5 driver that could cause system instability, denial of service, or potentially arbitrary code execution, and a use-after-free in the IPv4 networking component that could cause instability or denial of service. The advisory does not confirm any automotive deployment; this could be relevant where the Linux kernel is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.8
cve-2026-19736
An out-of-bounds write flaw exists in the NXP MCUX TRNG entropy driver within Zephyr, affecting specific i.MX RT5xx and RT6xx chips (MIMXRT595S, MIMXRT555S, MIMXRT533S, MIMXRT685S, MIMXRT633S) where the vendor SDK enables software health tests. An attacker with access to the entropy device, including an unprivileged user-mode thread when userspace is enabled, can request a non-word-multiple length such as 1 byte and cause the kernel to write up to 127 bytes beyond the intended buffer, resulting in memory corruption that could crash the system, corrupt kernel state, or enable privilege escalation. This could be relevant where this Zephyr entropy driver is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.8
cve-2026-19669
A flaw in Zephyr's fuel gauge syscall verifiers lets any user-mode thread with userspace enabled pass an unchecked length value that overflows the kernel stack, allowing an attacker to write controlled data into privileged memory and potentially execute kernel code or crash the system. The advisory rates this as a sandbox escape from user mode into kernel memory, with a length of roughly 170 already enough to exhaust the default 1024-byte privileged stack. This could be relevant where Zephyr is deployed in automotive systems, such as ECUs or telematics units running the affected fuel gauge driver with userspace enabled. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.8
cve-2026-19575
A type-confusion flaw in Zephyr's device_deinit system call handler lets an unprivileged user-mode thread pass a kernel object it already has permission on, such as a thread stack, which the kernel then misinterprets as a device structure. This allows a local attacker to achieve arbitrary kernel code execution in supervisor mode, fully defeating the CONFIG_USERSPACE isolation boundary, or to cause a system crash; the issue only affects builds enabling both CONFIG_USERSPACE and CONFIG_DEVICE_DEINIT_SUPPORT, and is rated as a high-severity local privilege escalation. This could be relevant where Zephyr is deployed in automotive systems, since Zephyr is used in embedded and automotive contexts. Confirm applicability through the product SBOM or dependency inventory.
csaf_susehigh · 7.8
suse-su-2026:4586-1
This SUSE Linux Enterprise 12 SP5 kernel live patch fixes six Linux kernel vulnerabilities, including a SCSI iSCSI target flaw (CVE-2026-63888) that causes an out-of-bounds read and a double-free, an IPv6 extension-header validation flaw (CVE-2026-63920) allowing an unprivileged out-of-bounds read, an NFC use-after-free (CVE-2026-64011), an IPv4 raw-socket validation flaw (CVE-2026-64114) that can panic the kernel, a PPPoE stale-pointer write (CVE-2026-68121), and an ALSA sequencer use-after-free (CVE-2026-68202). An attacker could trigger memory corruption, out-of-bounds reads, double-frees, or kernel panics depending on the flaw, with some reachable by unprivileged local users. The advisory does not state a numeric severity rating. This could be relevant where the Linux kernel is deployed in automotive systems, such as in IVI head units, telematics control units, or gateway ECUs. Confirm applicability through the product SBOM or dependency inventory.
csaf_susehigh · 7.8
suse-su-2026:4540-1
This Linux kernel live patch for SUSE Linux Enterprise 15 SP6 fixes eleven security vulnerabilities, including a SCSI iSCSI target flaw that allows an out-of-bounds read and a double-free, an IPv6 extension header validation flaw enabling an unprivileged out-of-bounds read, and a Bluetooth use-after-free, among others. An attacker could exploit these to cause kernel crashes, memory corruption, or denial of service, with severity ranging from out-of-bounds reads to remote kernel BUG() conditions. This could be relevant where the Linux kernel is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
csaf_susehigh · 7.8
suse-su-2026:4538-1
A flaw in the Linux kernel's veth network driver can cause an attacker to read a small amount of kernel memory and corrupt packet payloads when an XDP program adjusts packet fragment sizes, and SUSE rates this as a security issue fixed in its live-patching update. The affected component is the Linux kernel used by SUSE Linux Enterprise 15 SP7; this could be relevant where the Linux kernel is deployed in automotive systems, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
csaf_susehigh · 7.8
suse-su-2026:4536-1
This Linux kernel live-patch update fixes seven security flaws, including a use-after-free in the xfrm networking subsystem, a double-free and buffer overread in the iSCSI target code, and an out-of-bounds read in IPv6 extension header handling that an unprivileged local user could trigger. The most serious issues allow an attacker to corrupt kernel memory or crash the system, and the iSCSI flaws are remotely reachable by a network peer. This could be relevant where the Linux kernel is deployed in automotive systems, such as in-vehicle infotainment or gateway ECUs. Confirm applicability through the product SBOM or dependency inventory.
csaf_susehigh · 7.8
suse-su-2026:4531-1
This SUSE Linux Enterprise 15 SP4 live-patch update fixes seven Linux kernel vulnerabilities, including a SCSI iSCSI target flaw (CVE-2026-63888) that causes a four-byte out-of-bounds read and a double-free, an IPv6 extension-header validation flaw (CVE-2026-63920) allowing an unprivileged out-of-bounds read, and an RDMA/srpt integer overflow (CVE-2026-74394) that lets a malicious initiator bypass a bounds check and pass a roughly 4GB length to sg_init_one(). The advisory does not state a severity rating for any of these issues. This could be relevant where the Linux kernel is deployed in automotive systems, since these networking, storage and audio subsystems may be present in such environments. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.8
cve-2026-57559
A use-after-free memory corruption issue exists in Qualcomm Snapdragon DSP_Services, triggered while processing service requests. An attacker could potentially exploit this memory corruption to compromise the affected component, though the advisory does not state a specific severity rating. This could be relevant where Qualcomm Snapdragon DSP_Services is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.