icscert

Reports to icscert (89)

Latest CVEs (this partner and the CNAs under it) · RSS

• CVE-2026-107777 2026-10-16 · CVSS 6.5
  Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Serve
• CVE-2026-105667 2026-10-16 · CVSS 7.5
  In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassi
• CVE-2026-105279 2026-10-16 · CVSS 9.1
  In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and re
• CVE-2026-101021 2026-10-16 · CVSS 7.5
  MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying. Crafted multipart input can force excessive boundary comparisons and
• CVE-2026-105273 2026-10-16 · CVSS 7.5
  MP4Parser does not adequately validate MP4 box sizes. A malformed box can cause parsing to make no forward progress and repeatedly process the same input.
• CVE-2026-107621 2026-10-16 · CVSS 7.5
  JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.
• CVE-2026-97851 2026-10-16 · CVSS 9.1
  The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a locati
• CVE-2026-105664 2026-10-16 · CVSS 5.3
  The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response c
• CVE-2026-97858 2026-10-16 · CVSS 5.3
  An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is
• CVE-2026-107617 2026-10-16 · CVSS 9.8
  An attacker can use a hard-coded credential to log in to EseeCloud devices.
• CVE-2026-107564 2026-10-16 · CERTVDE · CVSS 8.7
  An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leadi
• CVE-2026-109813 2026-10-16 · Moxa · CVSS 8.6
  A hard-coded cryptographic key vulnerability exists in the `/usr/bin/sysman` of some of Moxa's industrial computing products. An unauthenticated attacker with a
• CVE-2026-109812 2026-10-16 · Moxa · CVSS 6.9
  A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authentica
• CVE-2026-105228 2026-10-16 · Deltaww · CVSS 7.0
  This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
• CVE-2026-105227 2026-10-16 · Deltaww · CVSS 7.0
  This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.
• CVE-2026-110936 2026-10-15 · siemens · CVSS 6.7
  A vulnerability has been identified in Siemens Software Center (All versions). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled
• CVE-2026-17525 2026-10-15 · ABB · CVSS 5.2
  Incomplete cleanup vulnerability in ABB My Control System. This issue affects My Control System: 26.4 and 26.5.
• CVE-2026-92817 2026-10-13 · CVSS 8.8
  The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vis
• CVE-2026-107607 2026-10-13 · CVSS 6.9
  SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on t
• CVE-2026-107606 2026-10-13 · CVSS 6.9
  SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on t
• CVE-2026-107605 2026-10-13 · CVSS 5.9
  SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could allow an attacker on t
• CVE-2026-65200 2026-10-13 · runZero · CVSS 3.5
  The openUBMC device-management process parses PLDM-over-MCTP and NCSI-over-MCTP responses from on-bus devices, and three response parsers in the shared transpor
• CVE-2026-65199 2026-10-13 · runZero · CVSS 5.4
  openUBMC assigns the full privilege set to pseudo-identities representing SNMP callers. An authenticated, but low-privilege, SNMP user can therefore invoke mapp
• CVE-2026-65198 2026-10-13 · runZero · CVSS 8.6
  Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the op
• CVE-2026-65197 2026-10-13 · runZero · CVSS 3.1
  H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file `/conf/public.pem`. That file is writable by