Automotive Vulnerabilities. Hunted worldwide every 24 hours, across 🇺🇸🇨🇳🇯🇵🇰🇷🇹🇼🇩🇪🇫🇷🇨🇭🇦🇹🇳🇱🇧🇪🇵🇱🇨🇦🇱🇺🇪🇺. Stay ahead.
3692advisories found
cvelistv5high · 8.7
cve-2026-62243
Netty versions 4.2.0 through 4.2.16 and versions through 4.1.136 disable TLS hostname verification on the OpenSSL client path under specific conditions, allowing a man-in-the-middle attacker to present a certificate for a different hostname that is accepted without validation. The issue is fixed in versions 4.2.17 and 4.1.137. This could be relevant where Netty is deployed in automotive systems, such as in telematics or communication modules, but the advisory does not confirm automotive use; confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 8.7
cve-2026-73523
COVESA Open1722 through 0.9.2 has a vulnerability in its CAN listener component where an unauthenticated remote attacker can send a specially crafted UDP datagram to cause the system to leak about 18 KB of process stack memory onto the CAN bus as roughly 240 CAN frames. The issue stems from an integer truncation error that makes the listener transmit far more data than intended. This could be relevant where Open1722 is deployed in automotive systems for Ethernet-to-CAN bridging; confirm applicability through the product SBOM or dependency inventory.
cvelistv5high · 8.7
cve-2026-8798
This vulnerability affects the cryptographic libraries used in automotive secure boot, over-the-air update verification, and secure communication between ECUs, where Bouncy Castle FIPS is often embedded in vehicle software stacks. An attacker exploiting a hardware or hypervisor-level failure of the CPU’s entropy source could cause the vehicle’s security functions to hang indefinitely, leading to a denial of service that might block critical operations like authentication or data decryption. The issue is severe because it can freeze the entire application using the library, but it is now fixed in version 2.1.3, so affected systems must be updated to prevent potential lockups.
NVDhigh · 8.7
CVE-2026-13505
CVE-2026-13505 affects Bouncy Castle for Java FIPS (BC-FJA) versions prior to 1.0.2.7, 2.0.2, and 2.1.3, where sensitive key material is zeroized via finalization, which can be delayed under load, causing memory exhaustion and leaving keys in heap longer than intended. This is particularly relevant for automotive systems using BC-FJA for cryptographic operations, as it could lead to denial of service or increased risk of key exposure. The fix uses a Cleaner to ensure timely disposal on Java 9 and later.
cvelistv5high · 8.7
cve-2026-66360
This vulnerability affects the IEC 61850 communication protocol stack used in electric vehicle charging stations, substation automation, and smart grid infrastructure that connects to automotive manufacturing plants and EV charging networks. An attacker can send a specially crafted network connection to trigger a memory read error, causing the system to crash and stop responding, which could disrupt EV charging operations or industrial control systems in automotive factories. The issue is rated as high severity because it requires no authentication and can be exploited remotely over the network to cause a denial of service.
cvelistv5high · 8.7
cve-2026-63559
This vulnerability affects the open62541 OPC UA stack, which is used in industrial control systems deployed in automotive manufacturing plants and assembly lines for secure machine-to-machine communication. An integer overflow in the UA_Variant arrayDimensions product computation could allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information from the plant network. This is a high-severity issue that could expose proprietary manufacturing data or control system details if exploited.
fkie_nvdhigh · 8.7
cve-2026-6924
This vulnerability affects the SiWx917 wireless chipset used in automotive IoT modules for telematics, keyless entry, and vehicle-to-everything communication. A bug in the entropy initialization causes the random number generator to produce predictable seeds, which could allow an attacker to guess cryptographic keys or session tokens used in Matter-based vehicle systems. The severity is limited because the impacted repository is already deprecated, but any vehicles still using this chipset for secure communications could be at risk.
fkie_nvdhigh · 8.7
cve-2026-50039
This vulnerability affects the CAN bus / automotive Ethernet network that connects ECUs within vehicles, specifically a stack-based buffer overflow in a component that processes Read Requests. An attacker could exploit this to cause memory corruption, potentially leading to system crashes or arbitrary code execution on the vehicle network. The severity is high, as it could compromise critical vehicle functions if exploited remotely or through physical access.
fkie_nvdhigh · 8.7
cve-2026-50032
This vulnerability affects the industrial control systems deployed in automotive manufacturing plants and assembly lines, where the MMS protocol is used for robot and equipment communication. A network-adjacent attacker could crash the server by sending a specially crafted WriteRequest with an empty listOfData field, causing a denial of service that halts production line operations. This is a high-severity issue that could disrupt vehicle assembly without requiring authentication.
csaf_phoenixcontactgmbhcokghigh · 8.6
vde-2026-084
Phoenix Contact reports that PLCnext devices and Virtual Controls with an integrated CodeMeter Runtime older than 8.41a contain license-validation vulnerabilities, and the advisory states these may occur on those products. Unauthenticated attackers can read and overwrite sensitive configuration data, take over the CodeMeter WebAdmin, crash the CodeMeter Runtime, and make licenses inaccessible, though the impact is limited to the licensing infrastructure. The advisory does not assign a severity rating; it recommends closed networks or firewalls and a fix planned in firmware version 2026.0.6 in Q4/2026.
csaf_phoenixcontactgmbhcokghigh · 8.6
vde-2026-098
Phoenix Contact software tools that use the Wibu-Systems CodeMeter Runtime (versions before 8.41a and 9.10) on Windows, Linux and Mac are affected by multiple vulnerabilities in license validation. Unauthenticated attackers can delete arbitrary files, read and overwrite sensitive configuration data, and crash the CodeMeter Runtime, with the most severe issue potentially allowing local privilege escalation on Windows. Fixes are planned for Q4 2026, and until then users should upgrade CodeMeter Runtime directly from Wibu-Systems and disable the network server function if not needed. This could be relevant where these Phoenix Contact engineering and licensed software tools are deployed in automotive manufacturing or engineering environments; confirm applicability through the product SBOM or dependency inventory.
fkie_nvdhigh · 8.6
fkie_cve-2026-43835
The advisory describes a vulnerability in firmware upgrade functionality that could let an authenticated attacker upload a forged firmware upgrade file, potentially compromising the device permanently. This could be relevant where this firmware upgrade component is deployed in automotive systems, since a forged upgrade could allow persistent compromise of affected devices. Confirm applicability through the product SBOM or dependency inventory.
fkie_nvdhigh · 8.6
fkie_cve-2026-109813
Moxa industrial computing products contain a hard-coded cryptographic key in the /usr/bin/sysman component, which an unauthenticated attacker with adjacent network access could exploit to compromise the confidentiality and integrity of communications. This could be relevant where Moxa industrial computing products are deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 8.6
rhsa-2026:83618
Red Hat has released an Important-rated security update for libsoup3, an HTTP and WebSocket library used by GNOME and other applications, fixing six heap buffer overflow flaws involving data-URI base64 decoding and WebSocket handling (Pong signals, message reassembly, receive-buffer growth, client-frame masking, and permessage-deflate compression). An attacker who can supply crafted data URIs or act as a remote WebSocket peer could trigger heap corruption, out-of-bounds reads, or denial of service in affected applications. This could be relevant where libsoup3 is deployed in automotive systems, for example in infotainment or telematics software that uses it for network communication. Confirm applicability through the product SBOM or dependency inventory.
csaf_redhathigh · 8.6
rhsa-2026:83384
The advisory describes heap buffer overflow flaws in libsoup, an HTTP client and server library for GNOME, affecting WebSocket handling in several ways, including Pong signal type confusion, message reassembly, receive-buffer growth, client-frame masking, and permessage-deflate compression. A remote WebSocket peer could trigger heap corruption or a crash, causing denial of service, and Red Hat rates these issues as Important severity. This could be relevant where libsoup is deployed in automotive systems, but the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73177
Nozomi Networks Labs found that the Advantech EKI-1242EIMS running firmware V1.06.01 accepts firmware images through its authenticated web management interface without verifying cryptographic signatures or certificates. An attacker with administrator-level access could install modified firmware, leading to full persistent compromise of the device. This could be relevant where the Advantech EKI-1242EIMS is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73176
Advantech EKI-1242IEIMS firmware V1.06.01 contains an OS command injection flaw in its web management interface, which a remote authenticated attacker could exploit to run arbitrary commands as root. This could be relevant where this device is deployed in automotive systems, such as industrial or roadside network environments. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73171
Advantech EKI-1242EIMS devices running firmware V1.06.01 contain a flaw in the backup-restore workflow that lets a remote authenticated attacker overwrite arbitrary files on the device by uploading a crafted backup archive through the web management interface. This could be relevant where such Advantech industrial networking equipment is deployed in automotive manufacturing or road-transport systems. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73170
Advantech EKI-1242EIMS firmware V1.06.01 contains a code injection flaw (CWE-94) in its Modbus CSV import workflow, which a remote authenticated attacker could exploit by importing a crafted file to execute arbitrary Lua code on the device. This could be relevant where the EKI-1242EIMS is deployed in automotive or industrial systems, though the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73167
Advantech EKI-1242IEIMS firmware V1.06.01 contains an OS command injection flaw in its web management interface, which a remote authenticated attacker could exploit to run arbitrary commands as root. This could be relevant where the Advantech EKI-1242IEIMS is deployed in automotive systems, though the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73166
The advisory describes a code injection vulnerability in the web management interface of Advantech EKI-1242IEIMS firmware V1.06.01, which allows a remote authenticated attacker to execute arbitrary code on the device, including OS commands as root. This could be relevant where this device is deployed in automotive systems, such as industrial networking in automotive manufacturing environments. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73165
Advantech EKI-1242IEIMS firmware V1.06.01 contains an OS command injection flaw in its web management interface, which a remote authenticated attacker could exploit to run arbitrary commands as root. This could be relevant where the Advantech EKI-1242IEIMS is deployed in automotive systems, though the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73164
Advantech EKI-1242IEIMS firmware V1.06.01 contains an OS command injection flaw in its web management interface, which a remote authenticated attacker could exploit to run arbitrary commands as root. This could be relevant where the Advantech EKI-1242IEIMS is deployed in automotive systems, though the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-73163
Advantech EKI-1242IEIMS firmware V1.06.01 contains an OS command injection flaw in its web management interface, which a remote authenticated attacker could exploit to run arbitrary commands as root. This could be relevant where the Advantech EKI-1242IEIMS is deployed in automotive systems, though the advisory does not confirm an automotive connection. Confirm applicability through the product SBOM or dependency inventory.
nvdhigh · 8.6
cve-2026-19535
Advantech EKI-1242IEIMS firmware V1.06.01 contains a cross-site request forgery flaw in its LuCI administrative web interface, which could let a remote unauthenticated attacker make unauthorized state-changing requests as a logged-in administrator, potentially gaining access to privileged management functions. The advisory does not confirm an automotive deployment, so this could be relevant where the affected Advantech device is deployed in automotive systems. Confirm applicability through the product SBOM or dependency inventory.