cvelistv5critical · 9.1
cve-2026-108266
Privasys rustls, a fork of the rustls TLS library with RA-TLS attestation support, had a flaw before version privasys-v0.8.1 where attestation evidence was not tied to the active TLS session. An attacker with an enclave TLS private key could relay a genuine attestation quote onto a different connection, tricking a relying party into trusting an attacker-controlled connection as the attested enclave. The advisory does not state a severity rating. This could be relevant where Privasys rustls is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.1
cve-2026-105794
MsQuic versions before 2.4.20, 2.5.11, and 2.6.1 that use the OpenSSL or QuicTLS TLS backend fail to properly verify that a server certificate matches the intended hostname. An on-path attacker could exploit this to impersonate the server and conduct a man-in-the-middle attack, though the advisory does not state a severity rating. This could be relevant where MsQuic is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
cvelistv5critical · 9.1
cve-2026-105216
The go-micro framework before version 6.0.0 contains a flaw where its shared TLS helper disables certificate verification by default, allowing a network attacker to impersonate services and intercept or modify traffic such as authentication tokens and credentials. This could be relevant where go-micro is deployed in automotive systems, particularly for service-to-service communications over gRPC, HTTP, RabbitMQ, Consul, or etcd. Confirm applicability through the product SBOM or dependency inventory.
csaf_abbcritical · 9.1
4jde002044
ABB's dynovaPRO product contains a flaw in its Keycloak authentication component that lets an unauthenticated attacker remotely hijack user accounts by abusing the "Forgot Password" function, requiring only the victim's email address. Successful exploitation could give an attacker control over user accounts and, depending on privileges, unauthorized access to data, system configuration changes, and control commands affecting operational devices such as chargers, batteries, and PV systems. ABB has deployed a cloud-side fix, blocked and forced password resets for potentially affected users, and states it had no confirmed reports of active exploitation as of August 27, 2026.
cvelistv5critical · 9.1
cve-2026-90647
The advisory describes an improper certificate validation flaw in the IEC 60870-5-104 TLS client of ASE/Kalkitech ASE2000 V2 Communication Test Set versions 2.35 through 2.37 on Windows, which a network-positioned attacker could exploit to bypass certificate validation and conduct a Man-in-the-Middle attack on protected communications. The advisory does not state a severity rating. This could be relevant where such communication test equipment is deployed in automotive or industrial systems; confirm applicability through the product SBOM or dependency inventory.
csaf_siemenscritical · 9.1
ssa-503852
Industrial Edge Management contains an authentication bypass vulnerability in its identity management component that lets an unauthenticated remote attacker reset user credentials without completing email verification, potentially leading to full account takeover. Siemens has released updated versions to fix this issue and recommends updating. This advisory does not explicitly state an automotive connection, so this could be relevant where Industrial Edge Management is deployed in automotive manufacturing or related systems; confirm applicability through the product SBOM or dependency inventory.
csaf_mettlertoledogmbhcritical · 9.1
vde-2026-088
METTLER TOLEDO's LabX Standard software versions 21.3.22 through 21.4.23 contain multiple vulnerabilities, including denial-of-service, authentication bypass, memory corruption, and potential remote code execution. Three specific vulnerabilities are fixed in version 21.4.25, while others await future releases. This could be relevant where LabX Standard is deployed in automotive laboratory or manufacturing environments, so confirm applicability through the product SBOM or dependency inventory.
csaf_cisacritical · 9.1
icsa-26-237-07
The advisory covers the FURUNO FA-50 Class B AIS Transponder, a marine navigation device used in transportation systems. An attacker with network access and credentials could alter device settings, and some configuration changes may be possible without authentication. The stated impact is that successful exploitation could allow an attacker to alter device settings, with no known public exploitation reported. This could be relevant where the transponder is deployed in automotive or road-transport systems, though the advisory focuses on maritime use. Confirm applicability through the product SBOM or dependency inventory.
csaf_siemenscritical · 9.1
ssa-825228
This vulnerability affects industrial control systems deployed in automotive manufacturing plants and assembly lines, specifically Siemens Siveillance Video Management Servers used for facility surveillance. An attacker with edit permissions to the Management Server could execute arbitrary code on the server, potentially disrupting plant security monitoring or gaining deeper access to factory networks. Siemens has released updated versions to fix this issue, and immediate patching is strongly recommended to protect manufacturing operations.
csaf_siemenscritical · 9.1
ssa-814963
This vulnerability affects the Mendix low-code platform, which is used by some automotive manufacturers and suppliers to build vehicle-related applications such as fleet management portals, dealer service tools, and production tracking dashboards. A documentation gap in Mendix's access rules could lead developers to unintentionally expose sensitive user data or allow privilege escalation, potentially giving an anonymous user access to all stored records. Siemens rates this as a high-severity issue and urges developers to review their access rule configurations immediately.
cvelistv5critical · 9.0
cve-2026-102167
Arista Wi-Fi access points contain a memory corruption flaw in their wired uplink network endpoints, which an unauthenticated attacker on the same network segment could exploit to crash the sensor service or potentially achieve remote code execution. This could be relevant where such access points are deployed in automotive manufacturing, logistics, or connected-vehicle environments, though the advisory does not confirm any automotive deployment. Confirm applicability through the product SBOM or dependency inventory.
csaf_siemenscritical · 9.0
ssa-254516
Siemens has disclosed a vulnerability in the Open Interface Services (OIS) web module used in its Siveillance Control and Siveillance Control Pro products. An attacker could exploit this flaw to upload arbitrary files, potentially gaining root-level access and fully compromising the affected system. Siemens has released patches and recommends updating to the latest versions to mitigate the risk.
certfr_aviscritical
certfr-2026-avi-1476
Multiple vulnerabilities were discovered in Cisco products, including Unified Industrial Wireless, Expressway Series, Expressway Select Series, Duo Access Gateway, Ultra-Reliable Wireless Backhaul and Identity Services Engine Portal Builder, and they allow an attacker to cause remote arbitrary code execution. The advisory does not state a severity rating. This could be relevant where these Cisco components are deployed in automotive or industrial wireless systems; confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1438
Belden macmon versions 6.x and 7.x without the latest security patch, and NetModule Router Software (NRSW) versions prior to 5.0.0.104, contain multiple vulnerabilities that allow a remote attacker to execute arbitrary code. The advisory does not state a severity rating beyond describing the impact as remote arbitrary code execution. This could be relevant where macmon or NRSW are deployed in automotive or road-transport environments, but the advisory does not confirm an automotive connection; confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1393
Moxa products are affected, specifically NPort W2150A-W4/W2250A-W4 Series before v1.5.9 and Remote Connect Suite before v4.2.2, with the advisory also noting the OnCell G3150A-LTE Series is end of life. An attacker could exploit these vulnerabilities to achieve arbitrary code execution, remote denial of service, data integrity and confidentiality compromise, and security policy bypass. This could be relevant where Moxa NPort or Remote Connect Suite components are deployed in automotive or industrial systems; confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1396
Palo Alto Networks products are affected, specifically Prisma Cloud Application Security Transporter Client versions before 0.2.9 and several PAN-OS versions (12.2.x before 12.2.4-h1, 11.2.x before 11.2.10-h17, and 12.1.x before 12.1.7-h11). An attacker could exploit the vulnerability to achieve remote arbitrary code execution, remote denial of service, and compromise of data confidentiality and integrity. The advisory does not state an explicit severity rating, but fixes are pending for additional PAN-OS versions. This could be relevant where these Palo Alto Networks components are deployed in automotive systems; confirm applicability through the product SBOM or dependency inventory.
githubcritical
ghsa-826v-5gj2-v5c8
The advisory describes a missing-authentication flaw in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware versions 0.3.9.7 through 0.6.6.9, where the device ships with host key authorization disabled and USB debugging on by default, letting an attacker obtain an unauthenticated shell (uid 2000) as a foothold for privilege escalation to root. If ADB over TCP is enabled, the same unauthenticated shell is reachable over the network, and the stated severity is CVSS 4.0 base 9.3. This could be relevant where the affected DJI CrystalSky device is deployed in automotive or embedded-system contexts; confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1376
Multiple vulnerabilities were discovered in the Ubuntu Linux kernel, affecting several Ubuntu releases including 14.04 ESM, 16.04 ESM, 18.04 ESM, 20.04 ESM, 22.04 LTS, 24.04 LTS and 26.04 LTS. Some of these flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service, with the advisory also listing impacts on data integrity, data confidentiality, security policy bypass, and remote XSS and CSRF injection. This could be relevant where the Ubuntu Linux kernel is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1360
Multiple Cisco products are affected, including IOS XE, IOS XR, Secure FTD, Snort 3, Expressway Series, Secure Client, Cyber Vision, and several collaboration products, with fixes available only through Cisco's security bulletins. The advisory states that some of these vulnerabilities allow a remote attacker to execute arbitrary code, escalate privileges, and cause a denial of service, with impacts also listed as data integrity, security policy bypass, and data confidentiality. This could be relevant where Cisco networking or security components are deployed in automotive systems, but the advisory does not confirm any automotive deployment; confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1367
Multiple vulnerabilities were discovered in Node.js versions 26.x before 26.12.1, 22.x before 22.23.4, and 24.x before 24.22.1, and some of them allow an attacker to achieve remote arbitrary code execution, a security policy bypass, and an unspecified security issue. The advisory does not state a severity rating, noting only that it is unspecified by the publisher, and it directs users to the publisher's security bulletin for fixes. This could be relevant where Node.js is deployed in automotive systems, embedded environments, or automotive manufacturing tooling; confirm applicability through the product SBOM or dependency inventory.
csaf_ncscnlcritical
ncsc-2026-0443
PHP has released fixes for two critical vulnerabilities that can be exploited remotely without authentication to run arbitrary code, affecting all PHP installations that process web requests. The first involves memory corruption when handling an out-of-memory condition, and the second involves internal global state persisting after memory is freed and being reused by a later request on the same worker; both can lead to remote code execution, and the advisory rates the likelihood as high. This could be relevant where PHP is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
ossf_malicious_packagescritical
mal-2026-17922
The advisory reports malicious code in the npm package @pkgship/frpc-linux-arm64, and states that any computer with this package installed or running should be considered fully compromised, with all secrets and keys rotated immediately from a different computer. Because full control of the machine may have been given to an outside entity, removing the package is advised but does not guarantee that all malicious software is gone. This could be relevant where this package is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1334
Multiple vulnerabilities were discovered in the Red Hat Linux kernel, and some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation, and remote denial of service. The affected component is the Red Hat Linux kernel across numerous Red Hat Enterprise Linux and CodeReady Linux Builder releases and architectures. The advisory does not specify a severity rating, and it does not confirm an automotive connection; this could be relevant where the Red Hat Linux kernel is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1317
Multiple vulnerabilities have been discovered in F5 products, including NGINX Open Source, NGINX Plus, NGINX Ingress Controller, NGINX Gateway Fabric, and related F5 modules, and they could allow an attacker to achieve remote arbitrary code execution, a breach of data confidentiality, and a breach of data integrity. The advisory also notes remote denial of service as an impact. This could be relevant where these components are deployed in automotive systems, for example in connected-vehicle backends or telematics infrastructure; confirm applicability through the product SBOM or dependency inventory.
certfr_aviscritical
certfr-2026-avi-1307
Multiple vulnerabilities have been discovered in Curl affecting versions prior to 8.23.0, and they could allow an attacker to achieve remote arbitrary code execution, remote denial of service, and a breach of data confidentiality. The advisory does not specify a severity level. This could be relevant where Curl or libcurl is deployed in automotive systems, so confirm applicability through the product SBOM or dependency inventory.