Exposure monitor
Vulnerabilities
Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
3692advisories found
fkie_nvdcritical · 9.3
fkie_cve-2026-109587
FreeRTOS-Kernel versions V11.3.0 and V11.3.1 contain an incorrect authorization flaw in the Arm Cortex-R82 MPU port that could let an unprivileged task read and write privileged kernel memory outside its assigned regions by passing a crafted buffer argument to an MPU system call. The advisory does not state a severity rating. This could be relevant where FreeRTOS-Kernel is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
fkie_nvdcritical · 9.3
fkie_cve-2026-109588
FreeRTOS-Kernel versions V11.3.0 and V11.3.1 on the Arm Cortex-R82 MPU port contain a flaw where a buffer length is truncated during an MPU authorization check, potentially letting an unprivileged task read or write privileged kernel memory beyond the validated buffer window through a stream buffer system call. This could be relevant where FreeRTOS-Kernel is deployed in automotive systems, since it is a real-time operating system used in embedded environments. Confirm applicability through the product SBOM or dependency inventory.
csaf_sickcritical · 9.3
sca-2026-0014
Multiple vulnerabilities in the third-party fast-xml-parser component affect the Device Manager Extension in SICK Sentio Creator, and successful exploitation could impact the security of Sentio Creator itself. An attacker could crash the application via stack overflow, bypass entity encoding to cause cross-site scripting when parsed output is rendered, or force excessive entity expansion that freezes the application. SICK recommends upgrading the extension to remediate these issues and minimizing network exposure of affected devices.
cvelistv5critical · 9.3
cve-2026-39460
Red Lion Controls N-Tron 700 Series switches store usernames and passwords, including default factory credentials, in plaintext in the configuration file, which an attacker with administrator rights could view via the CLI or export via TFTP from the web interface, and a TFTP transfer can be initiated through unauthenticated SNMP. This could be relevant where such switches are deployed in automotive manufacturing or industrial networks. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.3
cve-2026-103416
Eclipse ThreadX NetX Duo version 6.5.1.202602 contains an out-of-bounds write in its TLS 1.3 handshake message cache, where a handshake message larger than the cache can overwrite adjacent session control block memory that holds pointers. A malicious or compromised server can trigger this before certificate authentication completes, meaning no valid server certificate is required, allowing memory corruption that could lead to code execution or a crash. This could be relevant where NetX Duo is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdcritical · 9.3
cve-2026-73172
Advantech EKI-1242EIMS devices running firmware V1.06.01 contain an OS command injection flaw in the edgserver management service, which a remote unauthenticated attacker could exploit by sending crafted requests to TCP port 5058 to execute arbitrary commands as root. This could be relevant where such devices are deployed in automotive or industrial systems. Confirm applicability through the product SBOM or dependency inventory.
nvdcritical · 9.3
cve-2026-84696
Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles. This could be relevant where the PS3111-S11 controller is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
nvdcritical · 9.3
cve-2026-55068
The advisory describes a vulnerability in free5GC, an open-source 5G core network implementation, where the Network Repository Function (NRF) fails to validate incoming network function profiles. An attacker with access to the service-based interface could submit malicious profiles, poisoning the registry to redirect control-plane signaling, potentially exposing credentials, disrupting service discovery, and causing denial of service across network functions. The issue affects versions 4.2.2 and earlier, with a fix available in version 4.2.3. This could be relevant where free5GC is deployed in automotive systems, such as for vehicle-to-everything or private 5G networks; confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.3
cve-2026-77234
Improper input validation in FreeRTOS-Kernel before version 11.3.1 could allow an unprivileged task on MPU-enabled ports to execute code in privileged kernel context, potentially leading to full system compromise. The advisory recommends upgrading to version 11.3.1 or later to remediate the issue. This could be relevant where FreeRTOS-Kernel is deployed in automotive systems, such as in embedded control units, and the severity is significant due to the privilege escalation risk; confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.3
cve-2025-13293
This vulnerability affects the cellular baseband and telematics hardware used in TBEA TLogger devices, which are communication boxes deployed in electric vehicle charging and energy management systems. An attacker can exploit a hard-coded root password to gain full administrative control over the device via its exposed SSH service, allowing them to tamper with charging operations, steal data, or disrupt grid connectivity. The severity is critical because it requires no authentication and grants complete remote control, potentially impacting fleet operations and charging infrastructure reliability.
cvelistv5critical · 9.2
cve-2026-116014
The advisory describes an integer overflow and heap buffer overflow in open62541 versions 1.5.0 before 1.5.7, triggered when a malicious OPC UA server supplies large custom DataType definitions to a client, which can crash the client or enable code execution. The advisory does not state an automotive connection, so this could be relevant where open62541 is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
fkie_nvdcritical · 9.2
fkie_cve-2026-102551
Amazon FreeRTOS-Plus-TCP before V4.4.2 improperly verifies the source of IPv6 Router Advertisement messages, which could let a remote third party influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration using a crafted Router Advertisement. This could be relevant where FreeRTOS-Plus-TCP is deployed in automotive systems, since it is an embedded TCP/IP stack used in connected devices. Confirm applicability through the product SBOM or dependency inventory.
fkie_nvdcritical · 9.2
fkie_cve-2026-16436
Mitsubishi Electric GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32, and BizViz are affected by a weak password recovery mechanism in which the challenge response used to unlock the system is fixed and common to all users. A remote attacker who obtains that challenge response by some means can unlock the system and may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service condition. This could be relevant where these products are deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.2
cve-2026-109399
SWUpdate through 2026.05.1 has a certificate validation flaw in its CMS signature verification code that causes it to trust untrusted X.509 certificates embedded in the signed data when building a certificate chain. An attacker who holds a signing key from a sibling intermediate certificate under the same root can exploit this to bypass signature verification and install malicious software updates. The advisory does not state a severity rating. This could be relevant where SWUpdate is deployed in automotive systems, since it is an update mechanism used on embedded devices. Confirm applicability through the product SBOM or dependency inventory.
nvdcritical · 9.2
cve-2026-92943
AWS IoT Device SDK for Python versions 1.5.3 through 1.6.0 on Python 3.7 and later contain improper certificate validation with host mismatch in the MQTT client TLS connection layer. An adversary-in-the-middle actor could impersonate the AWS IoT Core endpoint, read device telemetry, and inject arbitrary MQTT messages that the device processes as authentic, using a certificate issued for an unrelated hostname by a certificate authority present in the device trust store. The advisory does not state a severity rating; upgrading to version 1.6.1 remediates the issue. This could be relevant where the AWS IoT Device SDK for Python is deployed in automotive systems, for example in connected-vehicle telematics or EV-charging backends that use AWS IoT Core. Confirm applicability through the product SBOM or dependency inventory.
nvdcritical · 9.2
cve-2026-3869
A CWE-303 authentication algorithm implementation flaw exists in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs, and it could cause loss of confidentiality, integrity and availability of the PLC when an application project with a lower application level is running on it. This could be relevant where these PLCs are deployed in automotive manufacturing or industrial control systems. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.2
cve-2026-67367
SIMOVE Fleetmanager and SIPLANT are affected by a vulnerability in their embedded HTTP server that fails to block directory traversal, allowing an unauthenticated remote attacker to read arbitrary files from the underlying operating system, potentially exposing sensitive data such as credential stores, private keys, and configuration secrets. The advisory does not confirm automotive deployment, but these products could be relevant where they are used in automotive or industrial fleet-management systems. Confirm applicability through the product SBOM or dependency inventory.
fkie_nvdcritical · 9.2
cve-2026-49035
This cellular baseband vulnerability affects the 4G/5G modems used in telematics control units and eCall systems. An attacker could exploit a heap-based buffer overflow by sending a specially crafted MMS Initiate request, potentially achieving remote code execution if memory protections are disabled, or causing a denial of service otherwise. This is a critical issue that could allow remote compromise of vehicle communication systems.
csaf_wagogmbhcokgcritical · 9.1
vde-2026-102
WAGO's Building Cloud Service had a vulnerability in its authentication and credential recovery process that could let an unauthenticated attacker bypass verification during password resets and take over arbitrary user accounts. Successful exploitation could give the attacker the compromised user's privileges, potentially exposing sensitive information, allowing misuse of privileged functions, or enabling changes to system settings. The flaw was fixed in the centrally managed service on August 26 with no customer action required, though customers are advised to review account activity for unexpected password changes. This could be relevant where WAGO building or industrial components are deployed in automotive manufacturing or facility systems; confirm applicability through the product SBOM or dependency inventory.
csaf_opensusecritical · 9.1
rhsa-2026:92145
Red Hat rates this cjose flaw Critical (CVSS 9.1) and lists Red Hat In-Vehicle OS 2 among affected products, so it is directly relevant to automotive deployments. When cjose encrypts a JWE object using AES-CBC-HMAC algorithms, it uses an all-zero encryption key instead of a random one, so an attacker who intercepts the encrypted message can decrypt sensitive plaintext and alter or forge content, causing information disclosure and loss of data integrity (availability is unaffected). Fixes for affected Red Hat product streams are being pursued through delegated resolution.
csaf_opensusecritical · 9.1
rhsa-2026:92154
Red Hat rates this cjose library flaw as Critical (CVSS 9.1). When cjose encrypts a JSON Web Encryption object using AES-CBC-HMAC algorithms, it uses an all-zero encryption key instead of a securely random one, so an attacker who intercepts the encrypted message can decrypt sensitive plaintext and alter or forge its content, causing information disclosure and loss of data integrity. The advisory explicitly lists Red Hat In-Vehicle OS 2 among affected products, so this is directly relevant to automotive deployments of that platform.
csaf_redhatcritical · 9.1
rhsa-2026:83617
This OpenSSL security update for Red Hat Enterprise Linux 9.6 Extended Update Support addresses seven vulnerabilities, including a high-severity heap use-after-free in PKCS7_verify() that can cause crashes, memory corruption, or potentially remote code execution, and several moderate flaws allowing denial of service, information disclosure, or message forgery. These issues affect applications using OpenSSL's CMS, PKCS7, QUIC, RSA key encapsulation, and AES-OCB functions, with the most severe requiring an attacker to send specially crafted messages to a vulnerable service. This could be relevant where OpenSSL is deployed in automotive systems, particularly in vehicle-to-cloud communications, OTA update signing, or embedded TLS stacks. Confirm applicability through the product SBOM or dependency inventory.
csaf_siemenscritical · 9.1
ssa-377139
Siemens Industrial Edge Device Kit contains multiple path traversal vulnerabilities that could let an authenticated remote attacker access sensitive internal information, and in the worst case use that access to gain unauthorized access to the system or delete data. Siemens has released new versions for several affected products and recommends updating to the latest versions, and has provided specific countermeasures where fixes are not yet available. Users of Industrial Edge Devices should consult the respective security advisories for their devices.
csaf_siemenscritical · 9.1
ssa-832641
Siemens Industrial Edge Devices contain path traversal vulnerabilities that let an authenticated remote attacker access sensitive internal information, and in the worst case could lead to unauthorized system access or data deletion. Siemens has released fixes for several affected products and is preparing further fixes, recommending updates and specific mitigations where fixes are not yet available. Siemens rates this as a security issue requiring network access protection and configuration according to its industrial security guidelines.
cvelistv5critical · 9.1
cve-2026-108267
Privasys Go, a fork of the Go programming language that adds RA-TLS support to crypto/tls, had a flaw before version privasys-v0.5.1-go1.26.5 in which challenge-mode RA-TLS certificates did not bind attestation evidence to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept a handshake terminated by the attacker as an attested enclave connection. This could be relevant where Privasys Go is deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.