Threat Library

A high-severity denial-of-service vulnerability (CVE-2026-12659) affects Rockwell Automation Flex 5000 Adapter version 6.011 due to a double-free condition triggered by crafted CIP packets. Successful exploitation halts the affected module, requiring a manual power cycle to restore operation, posing operational risk to industrial control environments.

AutomationDirect Productivity Suite versions up to v4.6.2.2 contain six vulnerabilities including out-of-bounds write/read flaws and a divide-by-zero condition, primarily triggered via crafted IOCTL requests to a kernel driver or malicious USB devices. Exploitation requires local or physical access and could lead to kernel memory corruption, privilege escalation, information disclosure, or denial-of-service on engineering workstations. No known public exploitation has been reported, and the vulnerabilities are not remotely exploitable.

Rockwell Automation Arena versions up to and including V17.00.00 contain four out-of-bounds write vulnerabilities (CVE-2026-8085, CVE-2026-8312, CVE-2026-8313, CVE-2026-8314) in the model.exe, expmt.exe, linker.exe, and siman.exe (Siman) components. Successful exploitation requires a user to open a malicious file, potentially allowing arbitrary code execution in the context of the current process. No public exploitation has been reported as of publication.

A critical cross-site scripting (XSS) vulnerability affects IBM Engineering AI Hub versions 1.0.0, 1.1.0, and 1.2.0, allowing remote attackers to inject and execute arbitrary scripts through improperly sanitized web page generation. Given the high CVSS score of 9.3, successful exploitation could lead to session hijacking, credential theft, and unauthorized actions performed in the context of authenticated users, including administrators.

A critical unauthenticated SQL injection vulnerability affects GisLab Laboratory Management System versions 1.4.03 through 08072026, allowing attackers to manipulate backend database queries. With a CVSS score of 9.8, this vulnerability could enable full database compromise, data exfiltration, or destruction without requiring valid credentials.

CVE-2026-12692 is a critical unverified password change vulnerability in Vimesoft Inc.'s Enterprise Video Platform, allowing attackers to bypass authentication by resetting user passwords without proper verification. With a CVSS score of 9.8, this flaw could allow full account takeover, including administrative accounts, with minimal attacker effort. Organizations running affected versions (3.11.0.0 to before 3.25.0) should treat this as an urgent patching priority.

Microsoft released patches for at least 570 security vulnerabilities in its July 2026 Patch Tuesday, nearly triple the prior month's record-setting release. Microsoft attributes the surge in discovered flaws to AI-assisted vulnerability research, signaling both increased attacker and defender use of AI tooling to find bugs at scale. Organizations face a substantially expanded patching burden across Windows and related Microsoft products.

Researchers at Checkmarx identified seven malicious npm packages targeting the Vite frontend tooling ecosystem, codenamed ViteVenom, which deliver a remote access trojan (RAT). The campaign extends the previously observed ChainVeil operation, leveraging a four-tier blockchain-based command-and-control infrastructure spanning multiple chains including Tron to evade takedown and detection.

A previously undisclosed OpenSSL flaw dubbed HollowByte allows an attacker to send an 11-byte crafted TLS request that forces an unpatched server to allocate up to 131 KB of memory for a message fragment that never completes, permanently consuming that memory on glibc-based systems until the process is restarted. OpenSSL silently patched the issue in June without issuing a CVE, advisory, or changelog entry, and Okta's Red Team later identified, named, and disclosed the bug.

A critical unauthenticated remote code execution vulnerability, dubbed wp2shell, was discovered in WordPress core affecting versions 6.9 and 7.0, exploitable via a single anonymous HTTP request even on default installs with no plugins. WordPress released patched versions 6.9.5 and 7.0.2 and pushed forced auto-updates to mitigate mass exploitation. Researcher Adam Kues of Assetnote (Searchlight Cyber) discovered and reported the flaw.

Ernst & Young (EY) disclosed a data breach stemming from the compromise of a third-party support ticket system used by its IT staff. The incident highlights ongoing risks associated with vendor and supply-chain access to sensitive internal support infrastructure. Details on the scope of data accessed and the threat actor responsible remain limited based on available reporting.

HollowByte is a denial-of-service vulnerability in OpenSSL that allows unauthenticated remote attackers to exhaust server memory using a malicious 11-byte payload. The flaw affects any service exposing an OpenSSL-based TLS listener, potentially causing crashes or severe resource exhaustion with minimal attacker effort.

Abbott Laboratories is investigating two separate cybersecurity incidents: unauthorized access to legacy Exact Sciences systems within its Cancer Diagnostics business, and a separate extortion claim involving alleged theft of data from its LabCentral portal. Both incidents are under active investigation and details on scope, data types affected, and threat actor identity remain limited.

A high-severity denial-of-service vulnerability (CVE-2026-9653) affects Rockwell Automation 1756-EN2, 1756-EN3, and 1756-ENBT communication modules due to improper validation of CIP Implicit Connection packets. A network-based attacker can send crafted packets to repeatedly disrupt device connections, though connections recover automatically. Rockwell Automation has released patches for the EN2 and EN3 modules, while the ENBT module is discontinued and will not receive a fix.

A stored cross-site scripting (XSS) vulnerability affects Rockwell Automation FactoryTalk DataMosaix Private Cloud versions 8.02 and earlier, allowing an authenticated high-privilege attacker to inject persistent malicious scripts via the Workflows configuration. Successful exploitation could lead to account takeover, credential theft, or redirection of other users to malicious sites when they access the affected page. No public exploitation has been reported to date.

Three vulnerabilities (CVE-2025-12011, CVE-2025-12012, CVE-2025-11698) affect multiple Rockwell Automation Logix controller families, allowing an unauthenticated remote attacker to send an invalid project or malformed file data that triggers a classic buffer overflow, causing the device to enter a major non-recoverable fault (MNRF). Exploitation results in denial-of-service impacting industrial control processes rather than data confidentiality or integrity loss. No known public exploitation has been reported to CISA at this time.

The Bricksforge WordPress plugin (versions up to 3.1.8.6) contains a critical privilege escalation flaw in its Pro Forms registration action. Improper validation of the fieldIds parameter allows unauthenticated attackers to whitelist arbitrary form fields, including the administrator role field, enabling full site takeover via crafted registration requests.

Yamcs, an open-source mission control framework, contains a vulnerability in its authentication endpoint that allows unlimited password-guessing attempts due to missing rate limiting and account lockout mechanisms. An unauthenticated remote attacker could exploit this to brute-force credentials for any user account. The issue is patched in versions 5.12.7 and 5.13.0.

CVE-2026-56453 affects HCL DFXAnalytics, allowing a remote attacker to intercept and manipulate HTTP responses to bypass authentication or authorization controls. This can result in unauthorized access to targeted user accounts without requiring credential theft.

Open WebUI versions prior to 0.3.14 contain a CORS misconfiguration (allow_origins=*) combined with authenticated cookie-based requests to the /api/v1/functions endpoint, enabling attacker-controlled websites to trigger arbitrary code execution on the server. Exploitation requires an authenticated admin to visit a malicious webpage, after which the attacker can silently deploy or modify server-side functions to achieve RCE. This poses a serious risk to any organization self-hosting Open WebUI as an interface for LLMs or agentic workflows.