Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
3692advisories found
csaf_cisahigh · 7.7
icsa-26-279-01
The advisory describes vulnerabilities in Johnson Controls EasyIO FG involving hard-coded credentials and improper privilege management that could let an attacker gain full unauthorized access to the device, potentially resulting in full device compromise. The advisory states these vulnerabilities have high attack complexity and are not exploitable remotely, and no public exploitation has been reported to CISA. This could be relevant where EasyIO FG controllers are deployed in automotive manufacturing or building systems environments; confirm applicability through the product SBOM or dependency inventory.
fkie_nvdhigh · 7.6
fkie_cve-2026-111459
Moxa Remote Connect Suite (MRC Client) contains an improper certificate validation vulnerability. An unauthenticated attacker with on-path access to communications between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack, potentially compromising the confidentiality and integrity of communications. This could be relevant where MRC Client is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 7.6
cve-2026-42804
A stack-based buffer overflow exists in the Bosch Sensortec BHI360 SensorAPI C-Library (versions up to and including commit d6b200416a), where the FIFO debug message parser trusts an attacker-supplied length byte and copies too many bytes into a fixed 17-byte stack buffer without bounds checking. An attacker with local or physical access, such as through a malicious sensor, counterfeit hardware module, or bus man-in-the-middle, could inject a crafted debug frame to corrupt stack memory and potentially execute arbitrary code on the host microcontroller or SoC, or cause a system crash. This could be relevant where the BHI360 SensorAPI is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.6
cve-2026-85197
A heap use-after-free vulnerability exists in libsoup's HTTP/2 client code, where a malicious server or man-in-the-middle attacker can trigger memory corruption by sending a GOAWAY frame while a file is being uploaded, potentially leading to information disclosure or arbitrary code execution. The flaw affects Red Hat Enterprise Linux versions 6 through 10. This could be relevant where libsoup is deployed in automotive systems, such as in GNOME-based infotainment or telematics applications, but the advisory does not confirm automotive use. Confirm applicability through the product SBOM or dependency inventory.
csaf_siemenshigh · 7.6
ssa-682041
The advisory describes a cross-site scripting vulnerability in the si-map component of the @siemens/maps-ng package, where an attacker can craft a malicious URL that executes arbitrary script code in a victim's browser when a map pin is hovered over. The affected component is a software package for rendering maps, and while it is not explicitly stated to be used in vehicles, this could be relevant where the package is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.6
cve-2026-80186
A vulnerability exists in BlueZ, the Linux Bluetooth protocol stack, where a remote attacker within Bluetooth range can send a specially crafted packet that overflows a buffer during device discovery. This can crash the Bluetooth service, causing a denial of service, and may allow the attacker to execute arbitrary code. This could be relevant where BlueZ is deployed in automotive systems for Bluetooth connectivity; confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.6
cve-2026-10685
This vulnerability affects the Bluetooth stack used in automotive hands-free calling, media streaming, and phone-as-a-key systems, specifically within the Zephyr RTOS that powers vehicle ECUs and telematics units. An attacker within Bluetooth range can trigger a use-after-free condition by sending a crafted error response during a GATT subscription, potentially causing memory corruption, system crashes, or arbitrary code execution in the vehicle’s Bluetooth host. This is a high-severity issue that could lead to denial of service or remote compromise of connected vehicle systems, and the fix requires updating the Zephyr Bluetooth stack to reorder callback handling.
fkie_nvdhigh · 7.6
cve-2026-16313
This vulnerability affects the Linux-based operating systems used in vehicle infotainment systems, telematics units, and diagnostic tools that rely on SCSI device management. An attacker who can connect a malicious USB or SCSI storage device to a vehicle system could inject arbitrary commands into the udev database, potentially executing code as root when the device is removed. This is a critical severity issue that could allow full system compromise of the affected automotive component.
cvelistv5high · 7.5
cve-2026-63341
Aedes, an MQTT broker that can run on any stream server, has a flaw before version 1.1.1 where it does not limit topic depth or complexity, so a PUBLISH, SUBSCRIBE, or registered Will message with an excessively deep topic can trigger an uncaught "too many words" exception that crashes the entire broker process. An attacker who can establish an MQTT session, authenticated or unauthenticated depending on broker configuration, can thereby disconnect all legitimate clients and prevent reconnection until the broker is restarted; the issue is fixed in version 1.1.1. This could be relevant where Aedes is deployed in automotive systems, for example as an MQTT broker in vehicle or fleet/telematics infrastructure. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.5
cve-2026-119197
pyasn1, a generic ASN.1 library for Python, is affected in versions prior to 0.6.5 by a denial-of-service flaw in binary REAL decoding, where attacker-supplied ASN.1 input with a large mantissa causes decode time to grow quadratically and can hold a decoding worker on one CPU core for seconds or longer, causing availability loss. This could be relevant where pyasn1 is deployed in automotive systems, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.5
cve-2026-119196
The pyasn1 Python ASN.1 library before version 0.6.5 has a flaw where decoding attacker-supplied BER or CER input containing many constructed BIT STRING fragments causes repeated shifting and copying of the accumulated bit value, leading to quadratic CPU consumption during decode() and potential CPU exhaustion. This could be relevant where pyasn1 is deployed in automotive systems, such as in embedded or telematics software that parses ASN.1 data. The advisory does not state a formal severity rating; the issue is fixed in version 0.6.5. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.5
cve-2026-119195
pyasn1, a generic ASN.1 library for Python, is affected in versions prior to 0.6.5 by a denial-of-service flaw in which attacker-controlled BER or CER data containing many constructed string fragments or indefinite-length ANY values causes quadratic-time decoding work. An attacker can exploit this to occupy decoding workers and exhaust CPU, with no impact on confidentiality or integrity. This could be relevant where pyasn1 is deployed in automotive systems, but the advisory does not confirm any automotive deployment; confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.5
cve-2026-119194
pyasn1, a generic ASN.1 library for Python, is affected in versions 0.3.3 through 0.6.4 by a flaw in schemaless BER/CER/DER container decoding that lets attacker-controlled input with many colliding tag IDs cause quadratic CPU consumption. An attacker could repeatedly send such inputs to exhaust decoder CPU and reduce service availability; the advisory does not state a formal severity rating. This could be relevant where pyasn1 is deployed in automotive systems, but the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.5
cve-2026-119191
Forge (node-forge), a JavaScript TLS implementation, prior to version 1.4.1 decodes ASN.1 data inside BIT STRING values without consistently applying its configured maxDepth limit, so crafted DER with nested BIT STRINGs can cause excessive recursion, high CPU use, and quadratic memory consumption during asn1.fromDer(). This could be relevant where node-forge is deployed in automotive systems, such as in telematics or embedded JavaScript-based services that parse untrusted certificates or ASN.1 data. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.5
rhsa-2026:92474
The advisory covers an update to the python3.12-urllib3 package for Red Hat Enterprise Linux 8, rated Important, addressing two flaws: a denial of service via unbounded memory allocation in the chunk parser (CVE-2026-97689) and traffic interception through an HTTPS proxy TLS configuration override (CVE-2026-97687). An attacker could crash client applications by sending an excessively long chunk-size line without a newline, or intercept and alter data through an HTTPS proxy, potentially impersonating the proxy to monitor or modify traffic or capture client credentials. This could be relevant where urllib3 is deployed in automotive systems, such as backend services or tooling handling outbound web communication. Confirm applicability through the product SBOM or dependency inventory.
fkie_nvdhigh · 7.5
fkie_cve-2026-111461
The advisory describes an OS command injection vulnerability in the OnCell G3150A-LTE Series that can be exploited when SMS management is enabled and configured, allowing a remote attacker with the required privileges to execute arbitrary commands on the device due to insufficient input validation. This could be relevant where this cellular gateway is deployed in automotive or fleet/telematics environments, since SMS-based management may be exposed in such deployments. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.5
rhsa-2026:88336
This Red Hat update fixes three Important-severity flaws in the Go libraries bundled with podman, the container management tool: a remote attacker can exhaust CPU via crafted HTTP Range headers or excessive HTTP/2 SETTINGS frames, causing denial of service, and a separate certificate-verification flaw in Go's crypto/x509 could let an attacker impersonate servers and conduct man-in-the-middle attacks on secure connections. The advisory does not state any automotive connection; this could be relevant where podman or Go-based container components are deployed in automotive systems, such as build, test or telematics back-end environments. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.5
rhsa-2026:85968
OpenSSL, the general-purpose cryptography and TLS/SSL toolkit shipped in several Red Hat Enterprise Linux 8 update streams, has two security flaws: a heap buffer overflow in CMS key unwrapping (CVE-2026-63072) and a DTLS handshake retransmission issue (CVE-2026-84782). An attacker could supply a crafted CMS message to an application using CMS_decrypt() to cause memory corruption and denial of service, or, over DTLS with non-blocking I/O, trigger out-of-bounds reads or process crashes; Red Hat rates the update Important, while the CMS flaw itself is described as moderate with limited denial-of-service impact. This could be relevant where OpenSSL is deployed in automotive systems, particularly any use of CMS decryption or DTLS over UDP, so confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 7.5
rhsa-2026:85970
OpenSSL, the general-purpose cryptography and TLS/SSL toolkit shipped with Red Hat Enterprise Linux 8.4, has two flaws: a crafted CMS message decrypted with CMS_decrypt() can cause an 8-byte out-of-bounds heap write leading to memory corruption and denial of service, and a DTLS handshake retransmission flaw can let a remote unauthenticated attacker read past a message buffer or corrupt internal state, causing information disclosure or a crash. Red Hat rates the update Important overall, with the CMS flaw described as moderate and the DTLS flaw as Important, and the DTLS issue only affects software using DTLS over UDP with non-blocking I/O, not standard TLS over TCP. This could be relevant where OpenSSL is deployed in automotive systems, such as embedded or telematics components using DTLS or CMS decryption; confirm applicability through the product SBOM or dependency inventory.
fkie_nvdhigh · 7.5
fkie_cve-2026-48741
libIEC61850, an open-source implementation of IEC 61850 client and server protocols, is affected by a NULL pointer dereference in its MMS read service prior to version 1.6.2. A remote attacker can send a crafted MMS Read request that crashes servers whose data models contain arrays, and the issue is fixed in version 1.6.2. This could be relevant where libIEC61850 is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
fkie_nvdhigh · 7.5
fkie_cve-2026-48503
libIEC61850 versions before 1.6.2 contain a flaw in its MMS file service where an unauthenticated remote client can send a crafted fileOpen request that causes the server to return more data than intended, potentially exposing stale bytes from a reused buffer. This could be relevant where libIEC61850 is deployed in automotive or industrial systems that use IEC 61850 communications, though the advisory does not confirm an automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
csaf_sickhigh · 7.5
sca-2026-0015
A vulnerability in the open-source sick_safetyscanners_base C++ driver library for SICK safety laser scanners allows a remote attacker to send a specially crafted network packet that causes the library to read beyond the bounds of the received buffer due to insufficient packet length validation. This could crash the affected application and cause a denial-of-service condition, potentially affecting availability of applications using the library. SICK recommends applying the defined remediations and minimizing network exposure of the devices.
fkie_nvdhigh · 7.5
fkie_cve-2026-73261
Mongoose, an embedded web server and network library, has a flaw in its built-in TCP/IP stack before version 7.23 where a malformed TCP option can cause an out-of-bounds read and corrupt the connection's MSS value. An unauthenticated remote attacker could exploit this so that later data sends transmit truncated or zero-length payloads while the connection still appears healthy, though the advisory does not state a severity rating. This could be relevant where Mongoose is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
fkie_nvdhigh · 7.5
fkie_cve-2026-83855
A flaw in the Windows WLAN Service could let an unauthorized attacker cause a denial of service over a network. This could be relevant where Windows-based systems are deployed in automotive environments, such as in-vehicle infotainment or telematics units. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 7.5
cve-2026-103577
Microsoft QUIC contains an insecure default variable initialization that lets an unauthorized attacker bypass a security feature over a network. The affected products are Windows 11 versions 23H2 through 26H2 and Windows Server 2022 and 2025, including Server Core installations. This could be relevant where Microsoft QUIC is deployed in automotive systems, since QUIC networking components may appear in connected vehicle or telematics platforms. Confirm applicability through the product SBOM or dependency inventory.