CVEs published by ICS-CERT

CVEs published by ICS-CERT (CVE Numbering Authority). 34 tracked.

• CVE-2026-63362 MEDIUM 5.9 An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attac
• CVE-2026-65423 HIGH 8.8 An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote att
• CVE-2026-66360 HIGH 7.5 The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiat
• CVE-2026-63550 MEDIUM 6.5 The MMS BER decoder contains a boundary-handling flaw in the processing of certain fields within confirmed-re
• CVE-2026-16581 MEDIUM 5.3 In igloohome Smart Lock Mobile App versions 3.2.3 and prior, an Inclusion of Sensitive Information in Source C
• CVE-2026-65421 MEDIUM 6.5 The MMS BER decoder contains a flaw in decoding fixed-width BER fields (boolean/integer): an attacker-supplie
• CVE-2026-66349 MEDIUM 6.5 The MMS server connection handler contains a flaw in its processing of BER-encoded request data
• CVE-2026-63559 HIGH 7.5 An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote att
• CVE-2026-18064 HIGH 7.5 An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application
• CVE-2026-63035 HIGH 8.1 A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authentica
• CVE-2026-61893 MEDIUM 6.5 A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand
• CVE-2026-63033 MEDIUM 6.5 A crafted IEC 60870-5-104 I-frame with a declared object count exceeding what fits in the ASDU body causes In
• CVE-2026-56758 MEDIUM 6.5 The ACSE layer contains a flaw in the processing of AARQ PDUs during MMS connection establishment
• CVE-2026-14227 MEDIUM 4.9 An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insuffic
• CVE-2026-17264 MEDIUM 4.3 Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled h
• CVE-2026-55676 HIGH 8.8 Malcolm is a network traffic analysis tool suite
• CVE-2026-63133 MEDIUM 6.5 Malcolm is a network traffic analysis tool suite
• CVE-2026-63177 HIGH 7.1 Malcolm is a network traffic analysis tool suite
• CVE-2026-63134 MEDIUM 5.4 Malcolm is a network traffic analysis tool suite
• CVE-2026-110243 CRITICAL 9.9 The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network inte
• CVE-2026-107861 CRITICAL 9.9 The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname paramet
• CVE-2026-109122 CRITICAL 9.1 The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used w
• CVE-2026-110491 HIGH 7.5 The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certai
• CVE-2026-92450 HIGH 7.5 The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens u
• CVE-2026-110825 HIGH 7.5 The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configura
• CVE-2026-96616 MEDIUM 6.5 Authentication tokens issued by the E3's web management interface on login are given an expiration time far be
• CVE-2026-111100 MEDIUM 5.3 The ONVIF device service on the E3 responds to certain informational requests without requiring authentication
• CVE-2026-105265 MEDIUM 5.3 A vulnerability exists in the the time zone parameter and does not properly validate user input, which may all
• CVE-2026-111594 HIGH 8.1 InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to vie
• CVE-2026-103672 HIGH 7.1 The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f
• CVE-2026-101103 MEDIUM 5.5 The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough
• CVE-2026-105960 MEDIUM 5.5 PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy
• CVE-2026-109576 MEDIUM 5.5 The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the reco
• CVE-2026-110322 MEDIUM 5.5 The PEAK-System PCAN type 0x4030 processing path fails to validate a selected/returned object pointer before d

← Back to latest CVEs