CVEs published by Johnson Controls

CVEs published by Johnson Controls (CVE Numbering Authority). 4 tracked.

CVE-2026-21662 CRITICAL 9.8 UPGRADE Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows U
CVE-2026-34495 MEDIUM 5.4 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson
CVE-2026-34497 MEDIUM 5.4 UPGRADE Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Control
CVE-2026-34490 MEDIUM 5.5 UPGRADE Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allow