Dragos

Latest CVEs · RSS

• CVE-2025-64124 2026-01-03 · CVSS 8.7
  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows
• CVE-2025-64125 2026-01-03 · CVSS 9.4
  A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (D
• CVE-2025-64123 2026-01-02 · CVSS 7.9
  Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack C
• CVE-2025-64122 2026-01-02 · CVSS 7.2
  Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Mul
• CVE-2025-64121 2026-01-02 · CVSS 10.0
  Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue a
• CVE-2025-64120 2026-01-02 · CVSS 9.4
  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows
• CVE-2025-64119 2026-01-02 · CVSS 9.3
  A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9.
• CVE-2025-7676 2025-07-28 · CVSS 5.4
  DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL i
• CVE-2025-53696 2025-07-28 · CVSS 9.3
  iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may conta
• CVE-2025-53695 2025-07-28 · CVSS 9.4
  OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device fi
• CVE-2024-1480 2024-04-19 · CVSS 7.5
  Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication.
• CVE-2022-45792 2024-01-22 · CVSS 7.8
  Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting file
• CVE-2022-45790 2024-01-22 · CVSS 8.6
  The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an
• CVE-2022-45794 2024-01-10 · CVSS 8.6
  An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC i
• CVE-2022-45793 2024-01-10 · CVSS 5.5
  Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in
• CVE-2023-29447 2024-01-10 · CVSS 5.7
  An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentic
• CVE-2023-29446 2024-01-10 · CVSS 4.7
  An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an a
• CVE-2023-29445 2024-01-10 · CVSS 7.8
  An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges
• CVE-2023-29444 2024-01-10 · CVSS 6.3
  An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges
• CVE-2023-40710 2023-08-24 · CVSS 6.8
  An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web
• CVE-2023-40709 2023-08-24 · CVSS 6.8
  An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have
• CVE-2023-40708 2023-08-24 · CVSS 5.8
  The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files.
• CVE-2023-40707 2023-08-24 · CVSS 8.6
  There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successf
• CVE-2023-40706 2023-08-24 · CVSS 8.6
  There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on th