Low
Last 30 days
In KEV catalog
ICS-CERT advisories
ICS threat actors
Threat Radar
Critical & high items — larger blips = higher priority. Hover for details.
Severity Breakdown
Top Vendors by CVE Count
Latest Advisories
Rockwell Automation 1718-AENTR/1719-AENTR
Rockwell Automation
Rockwell Automation recommends users to upgrade to 1718/ 1719 Ex I/O version 3.012 or later. Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight). For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
Rockwell Automation 1734 POINT I/O (Update A)
Rockwell Automation
Rockwell Automation recommends users are to migrate to 5034-OB8. Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight). For more information, see Rockwell Automation Security Advisories: https://www.rockwellautomation.com/en-us/trust-center/security-advisories.html.
Rockwell Automation Studio 5000 Logix Designer
Rockwell Automation
Rockwell Automation recommends users to upgrade to the following: Studio 5000 Logix Designer: V37.00, 36.01, 35.02, 34.04, 33.04, 32.05 (CVE-2026-9108) Customers using the affected software, who are not able to upgrade to one of the corrected versions, should use Rockwell Automation's security best practices (https://support.rockwellautomation.com/app/answers/answer_view/a_id/1085012/loc/en_US#__highlight). For more information, see Rockwell Automation Security Advisories: https://www.rockwellau
Johnson Controls C-CURE 9000 and Victor application server (Update A)
Johnson Controls
Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade to C-CURE 9000 v3.20 or later Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade victor Application Server to v4.20 or later Johnson Controls recommends the following upgrades to address the vulnerable deserialization path: Upgrade victor to v8.0 or later Johnson Controls recommends the following defensive measures to help reduce the r
Johnson Controls XAAP Android
Johnson Controls
Johnson Controls recommends users update the XAAP Android application to version 1.53 or later, which contains the fix for this vulnerability. Johnson Controls recommends users restrict physical access to devices running the XAAP Android application. Johnson Controls recommends users ensure devices are hardened with up-to-date Android OS versions, device encryption enabled, and screen lock protections in place. Johnson Controls recommends users implement a Mobile Device Management (MDM) solution
Critical Vulnerabilities
Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
Affected devices do not properly restrict executable content contained in imported trace files. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Successful exploitation could allow attacker-controlled JavaScript to execute in the user’s browser session and perform PLC operations through the web server within the scope of the user’s authorization.
An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industrial Printer version F10.19.010040, allows upload of attacker controlled files without requiring authentication. An attacker could potentially exploit this vulnerability, leading to the execution of malicious files and commands. Honeywell also recommends updating to the most recent firmware version, Honeywell PD45 Industrial Printer firmware F10.22.030745, which includes a fix for this vulnerability.
A critical OS command injection vulnerability has been identified in the Haiwell IoT Cloud HMI Gateway product. The vulnerability exists in the Net Check feature accessible via the /setting endpoint. The cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system, allowing an attacker to inject and execute arbitrary OS commands with root privileges.
Latest Intelligence
Threat actors have been observed using agentic artificial intelligence (AI) platforms for post-exploitation activity following the abuse of the PHP2Shell vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. "In one case, the attackers targeted a government entity in Europe and within two
Source: The Hacker News | Oct 25, 2026
LiteLLM on Friday revealed that an Agent Platform master key accidentally published to a public GitHub repository in late May 2026 ultimately allowed the threat actor to push a malicious version of the popular Python package. "On May 27, 2026, a configuration file was committed to the public LiteLL
Source: The Hacker News | Oct 24, 2026
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2
Source: The Hacker News | Oct 23, 2026
Nationwide lab test company Quest Diagnostics said one of its key systems may have experienced a breach of patient data.
Source: The Record | Oct 23, 2026
American clinical laboratory company Quest Diagnostics disclosed that patient records have been exposed after a threat actor gained unauthorized access to its Quanum LSM system. [...]
Source: BleepingComputer | Oct 23, 2026
About This Dashboard
Data aggregated from 20+ sources including NVD, CISA ICS-CERT, CISA KEV, MITRE ATT&CK for ICS, Dragos, ACSC, and curated OT/ICS news feeds. Updated automatically every 4 hours.
Threat level is computed from a weighted composite of critical CVE count, active exploitation status, KEV entries, and advisory volume. EPSS scores are sourced from FIRST.org.
Built and maintained by Implicit OT — specialist OT/ICS cybersecurity consultancy.
Need help securing your OT environment?
Implicit OT provides expert OT/ICS cybersecurity consulting for critical infrastructure.