Most recent vulnerabilities from the icscert CNA root

CVE-2026-79988 (Hackrate)

Thu, 27 Aug 2026 15:36:18 +0000

Authenticated RCE through Twig sandbox escape

CVE-2026-64896 (jci)

Thu, 27 Aug 2026 14:42:33 +0000

T2000 open debug port

CVE-2026-66155 (siemens)

Thu, 27 Aug 2026 11:56:48 +0000

A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.

CVE-2026-81625 (CERTVDE)

Thu, 27 Aug 2026 09:06:44 +0000

Stack buffer overflow in Greenbone OS and openvas-scanner

CVE-2026-19398 (ASUS)

Thu, 27 Aug 2026 02:00:16 +0000

“unsupported-when-assigned.” An out-of-bounds write in the SmiFlash SMM module of ASUS FA507NU and FA507NV BIOS allows a local administrator to cause a system crash (BSOD) or BIOS corruption via a crafted software SMI (SW SMI) request with an oversized length value.Refer to the ' Security Update for ASUS FA507NV / FA507NU BIOS ' section on the ASUS Security Advisory for more information.

CVE-2026-75960 (icscert)

Wed, 26 Aug 2026 13:20:19 +0000

Insufficiently Protected Credentials in Rently Smart Home

CVE-2026-15203 (Danfoss)

Wed, 26 Aug 2026 05:36:02 +0000

Debug interfaces are accessible by default in Danfoss iC7 Automation SP, iC7 Marine and iC7 7Hybrid software

CVE-2026-63587 (CERTVDE)

Tue, 25 Aug 2026 08:55:12 +0000

SMS Password Authorization Bypass via Failed Attempt Counter

CVE-2026-63586 (CERTVDE)

Tue, 25 Aug 2026 08:54:55 +0000

Unauthenticated Remote Code Execution via Shell Injection in Web Management Interface

CVE-2026-34491 (jci)

Mon, 24 Aug 2026 17:24:25 +0000

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.