Vulnerabilities are weaknesses or flaws in systems, software, hardware, configurations, or processes that adversaries can exploit to compromise confidentiality, integrity, or availability. The concept underpins vulnerability management, regulatory compliance, risk assessment, and security investment decisions across enterprise IT, cloud, and operational technology environments.
635 articles about Vulnerabilities
Decision Insights Threat Desk • November 13, 2025
CISA has released four advisories targeting specific vulnerabilities in Industrial Control Systems.
Decision Insights Threat Desk • November 13, 2025
Advantech's DeviceOn/iEdge, an IoT management platform, is subject to multiple vulnerabilities, including XSS and path traversal.
Decision Insights Threat Desk • November 13, 2025
Ubia's Ubox camera system has a vulnerability that allows unauthorized access to camera feeds due to insufficiently protected API credentials. CISA advises users on mitigation strategies, including minimizing network exposure and implementing firewall protections.
Decision Insights Threat Desk • November 13, 2025
ABB's FLXeon Controllers are identified with multiple vulnerabilities, including hard-coded credentials and improper input validation, allowing potential remote exploitation. Users are advised to implement mitigation strategies and update firmware to enhance security.
Decision Insights Threat Desk • November 13, 2025
AVEVA disclosed a vulnerability in its Application Server IDE, affecting versions up to 2023 R2 SP1 P02. The issue involves improper HTML tag neutralization, allowing potential XSS code exploitation. Recommended mitigations include updating to a later version and restricting network access.
Decision Insights Threat Desk • November 13, 2025
Rockwell Automation's Studio 5000 Simulation Interface has multiple vulnerabilities, including path traversal and SSRF, impacting versions 2.02 and prior. Affected users are advised to upgrade to version 3.0.0 or later and implement security best practices to mitigate potential risks.
Decision Insights Threat Desk • November 13, 2025
CISA has issued 18 advisories focused on vulnerabilities and security issues within various Industrial Control Systems (ICS).
Decision Insights Threat Desk • November 13, 2025
Rockwell Automation disclosed a vulnerability in FactoryTalk Policy Manager that could lead to denial of service. The affected versions are 6.51.00 and prior, with a CVSS v4 score of 8.7. Mitigations include updating to version 6.60.00 or later and following cybersecurity best practices.
Decision Insights Threat Desk • November 13, 2025
Rockwell Automation has reported a vulnerability in its Verve Asset Manager affecting multiple versions, allowing unauthorized access via the API. Affected users are urged to update to versions 1.41.4 or 1.42. The vulnerability, identified as CVE-2025-11862, has a CVSS v4 score of 8.4.
Decision Insights Threat Desk • November 13, 2025
Brightpick AI's warehouse automation platform is vulnerable to multiple security issues, allowing unauthorized access to critical functions and sensitive data. CISA recommends mitigations, but Brightpick has not engaged in collaborative response efforts. Users are encouraged to secure their systems against these vulnerabilities.
Decision Insights Threat Desk • November 13, 2025
CISA will cease updating ICS security advisories for Siemens vulnerabilities as of January 10, 2023. Siemens advises updating Spectrum Power 4 to V4.70 SP12 Update 2. Several serious vulnerabilities have been identified, allowing remote code execution and privilege escalation, requiring immediate attention.
Decision Insights Threat Desk • November 13, 2025
As of January 10, 2023, CISA stopped updating ICS advisories for Siemens vulnerabilities. A risk in Solid Edge allows remote attacks.