Indexed vulnerabilities with severity, CVSS, and vendor context.
Update Siemens Simcenter Nastran and Simcenter Femap to V2606 or later versions. Protect network access to devices with appropriate mechanisms. Follow Siemens' operational guidelines for Industrial Security. Minimize network exposure and ensure control system devices are not accessible from the internet. Use firewalls and isolate control system networks from business networks.
CISA recommends minimizing network exposure for all control system devices and ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. When remote access is required, use more secure methods such as VPNs, recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Perform proper impact analysis and risk assessment prior to deploying defensive measures. CareCam has not responded to CISA's coordination attempts; users are encouraged to reach out to the vendor directly.
Update Xiiaozet LK100W firmware to version 2.1.240 or later. As interim mitigations, minimize network exposure by ensuring the device is not accessible from the internet, locate it behind firewalls and isolate it from business networks, and use updated VPNs for any required remote access. Perform impact analysis and risk assessment before deploying defensive measures.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
Update to TPDIN-Monitor-WEB3 Firmware v2.4.2. Units on v2.2.9 should apply the Intel HEX update: https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex. Units already on v2.4.2 may use the signed container: https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw. Contact Tycon Systems for additional support.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
Update to TPDIN-Monitor-WEB3 Firmware v2.4.2. Units on v2.2.9 should apply the Intel HEX update: https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2T.hex. Units already on v2.4.2 may use the signed container: https://firm.tyconsystems.com/tpdin-monitor-web3-v2/TPDIN-MONITOR-WEB3-V2_v2.4.2.tfw. Contact Tycon Systems for additional support.
Users should update the Mira app to the latest version (iOS v3.5.18 / Android v4.5.18). Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required beyond applying these updates. Organizations deploying Mira devices should ensure all units are running the latest firmware and app versions and monitor for future security advisories from Quanovate Tech Inc.
Apply the engineering hotfixes released by F5 for CVE-2026-94127 immediately. Administrators should verify their BIG-IP APM configuration to determine if APM is functioning as an OAuth authorization server. If APM is not issuing access tokens to applications, the system is not affected by this vulnerability. Monitor F5 security advisories for further updates or full advisory releases.
Organizations should apply vendor-provided patches immediately. For Cisco ASA/FTD, consult Cisco security advisories. For Microsoft Windows, apply the latest security updates. For Metabase, follow the vendor's guidance. Additionally, review systems for indicators of compromise before patching, as recommended by BOD 26-04.
Apply the patches released by Red Hat and the Keycloak project immediately. Administrators should update their Keycloak installations to the latest patched versions to prevent exploitation. Review access controls and monitor for unusual password reset activity.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
SolarWinds has released security updates to address the flaw. Users should update Access Rights Manager to the latest patched version immediately. It is recommended to monitor SolarWinds advisories for additional details and to apply patches within established maintenance windows.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
As of the disclosure date, no patch information has been provided by Unitree. Organizations using the G1 EDU should monitor Unitree's official channels for firmware updates and security advisories. Until a patch is available, consider restricting network access to the robot and disabling Bluetooth when not in use. Additionally, ensure the robot is deployed in a controlled environment to minimize the risk of unauthorized physical or network access.
Upgrade to Mirth Connect v4.7.2 or later from the NextGen Healthcare customer portal. Minimize network exposure, isolate control system networks behind firewalls, and use updated VPNs for remote access.
Users should upgrade Roundcube Webmail to version 1.6.16 or 1.7.1 immediately to apply the fix for CVE-2026-48842. If immediate upgrading is not possible, consider disabling the virtuser_query plugin or implementing network controls to limit exposure. Monitor for patches from Roundcube developers and apply them as soon as possible.
As of the disclosure date, no patch information has been provided by Unitree. Organizations using the G1 EDU should monitor Unitree's official channels for firmware updates and security advisories. Until a patch is available, consider restricting network access to the robot and disabling Bluetooth when not in use. Additionally, ensure the robot is deployed in a controlled environment to minimize the risk of unauthorized physical or network access.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
Update affected Siveillance Video Management Server software to the latest hotfix versions: V23.3 HotfixRev27 or later, V24.1 HotfixRev16 or later, or V25.1 HotfixRev15 or later. Restrict network access to Management Server interfaces. Apply principle of least privilege for user permissions. Follow Siemens and CISA recommended security practices for industrial control system devices.
Users and administrators should update Google Chrome and Chromium-based browsers to the latest available version. CISA encourages organizations to apply security updates promptly and adopt risk-based vulnerability management practices. Federal agencies must follow BOD 26-04 requirements for prioritizing KEV Catalog remediation on publicly exposed assets.
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolating them from business networks. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. Users are encouraged to reach out directly to Pulsetto for assistance at info@pulsetto.tech.
Organizations should check Zyxel security advisories for firmware updates addressing CVE-2026-7273. Prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets. Apply defense-in-depth measures such as network segmentation and monitoring for anomalous switch behavior.
Rockwell Automation has released Redundancy Module Configuration Tool version 10.01.00 which addresses CVE-2026-9633 and CVE-2026-9634. Users are strongly advised to upgrade to the latest version immediately. Customers unable to upgrade should consult Rockwell Automation's security best practices and mitigation guidance published on the vendor's support portal and security advisories page. CISA recommends applying defensive measures outlined in advisory ICSA-26-244-02.
Apply the latest firmware/software updates for SMA 1000 series appliances immediately via SonicWall's support portal. Monitor SonicWall advisories for additional guidance. Segregate SMA appliances from untrusted networks where possible.
Apply the latest Microsoft security updates released as part of the July 2026 Patch Tuesday. Prioritize patching SharePoint servers to prevent exploitation of CVE-2026-55040. Monitor Microsoft security advisories for any additional guidance.
Upgrade Malcolm to version 26.06.1 or later to address CVE-2026-55676. Upgrade to version 26.07.0 or later to address CVE-2026-63133, CVE-2026-63134, and CVE-2026-63177. For CVE-2026-19670 and CVE-2026-19671, monitor CISA advisory for updates. Restrict access to the upload functionality to trusted users only.
Organizations using Ebyte NE2-D11 devices should: 1) Isolate affected devices from untrusted networks where possible, 2) Monitor for vendor communications regarding patch availability, 3) Contact Ebyte directly for updates on remediation, 4) Implement network segmentation and strict access controls to limit exposure, 5) Credentials should be rotated if exposure is suspected due to CVE-2026-73839.
Update Super Forms and Elementor Pro to the latest patched versions immediately. Apply all WordPress security updates. Monitor logs for suspicious file uploads or admin account creation. Implement web application firewall rules to block unauthorized file uploads.
JFrog has released security updates addressing CVE-2026-82329. Users should apply the latest Artifactory version containing the fix immediately. It is also recommended to review and restrict access controls, monitor for suspicious activity in CI/CD pipelines, and consult JFrog's official security bulletin for exact patch versions and mitigation steps.
As of the publication date, Cisco has not released a patch. Organizations should: 1) Monitor Cisco's security advisories for updates and patch availability. 2) Apply any recommended mitigations or workarounds provided by Cisco. 3) Restrict network access to ISE management interfaces to trusted hosts. 4) Review ISE logs for suspicious authentication attempts or unauthorized access. 5) Enable multi-factor authentication where possible to reduce risk.
Organizations should apply the AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update and migrate affected project files. For files that cannot be migrated, evaluate the risk of password leakage and implement stricter read access controls. Require PIMBoards users to change their passwords after migration. Migration is one-way due to changes in password hashing algorithms and encryption keys.
CISA and Cisco encourage affected organizations to apply vendor patches for Cisco Secure Email Gateway as soon as possible. Federal agencies must follow the remediation timelines and requirements specified in Binding Operational Directive (BOD) 26-04. Organizations should also check whether threat actors may have already compromised systems before applying patches, and document any pre-compromise indicators. All organizations are advised to adopt risk-based vulnerability management practices and prioritize remediation of KEV Catalog vulnerabilities on publicly exposed assets.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
Microsoft has released fixes that are applied automatically; no customer action is required. Organizations should verify that their Azure AI Foundry instances are updated and review Microsoft's security advisories for any additional guidance. It is also recommended to monitor for unusual activity and enforce least-privilege access controls.
Botslab has not responded to requests to work with CISA to mitigate these vulnerabilities. No official patch has been publicly confirmed. Users of affected firmware versions are advised to reach out to Botslab via the official website (https://www.botslab.com/pages/about-botslab) for guidance. Organizations should monitor for firmware updates, segment affected devices on networks where possible, and review access controls for dashcam deployments.
As of the advisory date, no patch is available. Ebyte has not confirmed a timeline. Organizations should: 1) Restrict network access to the device's web management interface to trusted users only. 2) Use network segmentation to isolate the device from untrusted networks. 3) Monitor device logs for unauthorized access or configuration changes. 4) Contact Ebyte for patch availability updates. 5) If possible, disable remote management features until a patch is applied.
Organizations should apply the AVEVA Pipeline Integrity Monitor 2025 SP1 P2 Security Update and migrate affected project files. For files that cannot be migrated, evaluate the risk of password leakage and implement stricter read access controls. Require PIMBoards users to change their passwords after migration. Migration is one-way due to changes in password hashing algorithms and encryption keys.
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
Organizations using Ebyte NE2-D11 devices should: 1) Isolate affected devices from untrusted networks where possible, 2) Monitor for vendor communications regarding patch availability, 3) Contact Ebyte directly for updates on remediation, 4) Implement network segmentation and strict access controls to limit exposure, 5) Credentials should be rotated if exposure is suspected due to CVE-2026-73839.
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
As of the advisory date, no patch is available. Ebyte has not confirmed a timeline. Organizations should: 1) Restrict network access to the device's web management interface to trusted users only. 2) Use network segmentation to isolate the device from untrusted networks. 3) Monitor device logs for unauthorized access or configuration changes. 4) Contact Ebyte for patch availability updates. 5) If possible, disable remote management features until a patch is applied.
As of the advisory date, no patch is available. Ebyte has not confirmed a timeline. Organizations should: 1) Restrict network access to the device's web management interface to trusted users only. 2) Use network segmentation to isolate the device from untrusted networks. 3) Monitor device logs for unauthorized access or configuration changes. 4) Contact Ebyte for patch availability updates. 5) If possible, disable remote management features until a patch is applied.
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
Update Siemens Reyrolle 7SR5 to version V2.70 or later. Apply the vendor fix via https://support.industry.siemens.com/cs/ww/en/view/109772413/. Monitor for future security advisories and restrict network access to the web management interface where possible.
D-Link recommends replacing the DIR-822A routers with supported hardware due to the lack of a patch. Users should disconnect legacy devices from the network if replacement is not immediately possible. Monitor D-Link advisories for any future security updates.