VulnHub

A vulnerability has been identified in the Mitsubishi Electric CC-Link IE TSN Communication Protocol that could allow attackers on the same network segment to manipulate communication data. This vulnerability, tracked as CVE-2026-13584, can lead to denial-of-service (DoS) conditions by disrupting the control functions of affected products. A wide range of Mitsubishi Electric MELSEC MX controllers, motion modules, and various remote and safety modules are affected, including models MX-R300, MX-R500, and several others. Users of these devices should be aware of the potential risks, as the exploitation of this flaw could significantly impair operational capabilities. Addressing this vulnerability is crucial for maintaining the integrity and reliability of systems relying on this communication protocol.

MikroTik RouterOS has a critical vulnerability (CVE-2026-14227) that allows attackers to extract the router's WireGuard private key using low-privilege API access. This could enable them to impersonate the VPN and decrypt all associated traffic. The flaw affects all versions of MikroTik RouterOS where the API is enabled, posing a significant risk to users globally. The issue arises from an insufficient session expiration, which means users may retain access even after their permissions have been downgraded. MikroTik advises that administrators log out affected users to enforce new permission policies effectively.

Toptech Systems has reported a serious vulnerability in its RCU II+ and Multiload II+ products, which could allow attackers to gain unauthorized control over these devices. The flaw, identified as CVE-2026-12562, affects all versions of RCU II+ and Multiload II+ released before November 24, 2025. This vulnerability stems from a debug interface that lacks authentication, enabling attackers to access the system's Linux environment directly. If exploited, this could lead to significant manipulation of connected networks and resources. Users are urged to take defensive measures, including isolating the devices from untrusted networks and applying available vulnerability removal tools or firmware updates to protect against potential exploitation.

A vulnerability has been identified in Watchfire Controller Software that could allow attackers to deliver malicious firmware and gain full control of affected devices. The flaw, designated as CVE-2026-5846, impacts several versions of the software, including BC550 12.30, BC750 11.33 and 12.35, BC760 12.38 and 13.00, and BC760DC 12.39. This issue arises from the use of hard-coded cryptographic keys within the firmware, which are stored in plaintext, posing a significant security risk. Users of the affected software, primarily in sectors such as healthcare and financial services, are urged to apply security patches provided by Watchfire to mitigate the risk. While no public exploitation of this vulnerability has been reported yet, organizations are advised to take proactive measures to secure their systems against potential attacks.

Johnson Controls has identified multiple vulnerabilities in their OpenBlue Employee software, specifically versions up to V2025.3.1. These flaws could allow attackers to upload malicious files, execute cross-site scripting (XSS) attacks, or inject harmful HTML content, posing significant risks to users. The vulnerabilities are particularly concerning as they affect critical infrastructure sectors, including manufacturing, transportation, and energy. Johnson Controls advises users to apply the latest updates and implement strong access controls to mitigate potential risks. The company has outlined specific defensive measures to help secure the application and protect users from exploitation.

MZ Automation GmbH's libiec61850 library, used in critical infrastructure like energy systems, has several vulnerabilities that could lead to denial-of-service attacks. Versions prior to 1.6.2 are affected by multiple issues, including improper validation of timestamps and flaws in the GOOSE and MMS message processing. Attackers could exploit these weaknesses by sending specially crafted messages, causing the affected services to crash. This poses a significant risk to operational reliability in systems relying on this library. Users are urged to update to version 1.6.2 to mitigate these risks.

MZ Automation's lib60870 version 2.4.0 has been found to have serious vulnerabilities that could lead to device crashes. Specifically, two CVEs (CVE-2026-61893 and CVE-2026-63033) involve out-of-bounds read issues triggered by maliciously crafted IEC 60870-5-104 I-frames. These vulnerabilities affect systems in critical infrastructure sectors, including energy and water management, and have been reported globally. Users are advised to update to version 2.4.1 as a mitigation step to protect against potential exploits. Currently, there have been no reports of these vulnerabilities being actively exploited in the wild.

Cisco's Secure Firewall Management Center (FMC) is facing a significant security issue due to a vulnerability identified as CVE-2026-20316. This flaw allows attackers to exploit static credentials associated with a low-privileged user account within the FMC's web interface. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, indicating that this vulnerability is being actively exploited by malicious actors. Organizations using Cisco FMC should take immediate action to secure their systems, as the exploitation of these credentials could lead to unauthorized access and potential control over network security settings. The report of this vulnerability was made by Jimi Sebree from Horizon3.ai, highlighting the urgency for affected users to address this issue promptly.

Ruby on Rails has addressed a serious vulnerability in its Active Storage component, identified as CVE-2026-66066, which has a CVSS score of 9.5. This flaw allows unauthenticated attackers to potentially access sensitive files on application servers through manipulated image uploads. The vulnerability could expose critical information, including the Rails process environment, secret_key_base, database passwords, and cloud storage credentials. Developers using Ruby on Rails should act quickly to secure their applications, as the ramifications of this flaw could lead to significant data breaches. The vulnerability underscores the importance of maintaining up-to-date software to protect against such risks.

Researchers have identified a serious vulnerability in Ruflo, an open-source agent meta-harness used for AI models like Anthropic Claude Code and OpenAI Codex. This flaw, known as CVE-2026-59726, has a maximum severity rating of 10.0, indicating that it allows unauthenticated attackers to execute remote commands on affected systems. The vulnerability impacts all versions of Ruflo prior to 3.16.3, making it critical for users to update to this version or later. If exploited, this could lead to unauthorized access and manipulation of AI memory, posing risks to data integrity and security. Organizations using Ruflo should prioritize applying the latest updates to safeguard their systems.

Broadcom has issued security updates to fix several vulnerabilities affecting VMware products, including ESX, vCenter, Workstation, and Fusion. Among these, three flaws are deemed critical, with CVE-2026-59309 being the most severe, rated at 9.8 on the CVSS scale. This particular flaw allows attackers with network access to VMware vCenter to bypass authentication, potentially leading to unauthorized access. Other vulnerabilities could enable code execution and VM escape, which poses significant risks for virtualized environments. Organizations using these VMware products should prioritize applying the updates to safeguard against potential exploits.

Broadcom has addressed a serious vulnerability in VMware ESXi that could allow attackers to execute code on a host machine from a compromised virtual machine. This flaw, identified as CVE-2026-47876, has a high severity rating of 9.3 on the CVSS scale, indicating a significant risk. Alongside this critical issue, Broadcom released patches for four other vulnerabilities affecting VMware's ESXi, vCenter, Workstation, and Fusion products, three of which are also classified as critical. Companies using these systems should prioritize applying the patches to safeguard their environments, as the potential for exploitation could lead to severe data breaches or system compromises.

The Cybersecurity and Infrastructure Security Agency (CISA) has added a new vulnerability to its Known Exploited Vulnerabilities Catalog, marking it as a significant risk due to active exploitation. The vulnerability, identified as CVE-2026-20316, affects the Cisco Secure Firewall Management Center and involves the use of a hard-coded password. This type of vulnerability is a common target for attackers and poses serious risks, particularly for federal agencies. CISA's Binding Operational Directive 26-04 mandates that federal agencies prioritize rapid fixes for such vulnerabilities to protect their systems. While the directive specifically applies to federal agencies, CISA encourages all organizations to adopt similar practices to manage vulnerabilities effectively.