| Date | Source | Type | Title | Author |
|---|---|---|---|---|
| Apr 30, 2026 | CISA | ICS Advisory | ICSA-26-120-01: ABB System 800xA, Symphony Plus IEC 61850 This vulnerability was privately reported relating to ABB’s implementation of the IEC 61850 communication stack for MMS client applications used in some Automation control system products. Note: IEC 61850 communication typically supports MMS and GOOSE protocols. Some ABB products support both, others only MMS (e.g. S+ Operations and PM 877). In any case, GOOSE communication is not impacted by this reported vulnerability. | CISA |
| Apr 30, 2026 | CISA | ICS Advisory | ICSA-26-120-03: ABB Edgenius Management Portal ABB identified a critical vulnerability present in ABB Ability Edgenius starting from version 3.2.0.0. We have not received any reports of this vulnerability being exploited. An unauthenticated attacker could exploit this vulnerability to: → install and run arbitrary code, → uninstall installed applications, → modify the configuration of installed applications, on systems running the vulnerable versions of ABB Ability Edgenius, including 3.2.0.0 through 3.2.1.1. | CISA |
| Apr 30, 2026 | CISA | ICS Advisory | ICSA-26-120-04: ABB Ability OPTIMAX ABB became aware of severe vulnerability in the products versions listed as affected in the advisory, if the optional integration with Azure Active Directory for Single-Sign On is enabled. We have not received any reports of this vulnerability being exploited. An attacker who successfully exploits this vulnerability could bypass user authentication and potentially cause the product to: - Shutdown the system, - Modify the configuration of the system, - Install and run arbitrary code | CISA |
| Apr 30, 2026 | CISA | ICS Advisory | ICSA-26-120-05: ABB AWIN Gateways ABB became aware of vulnerability in the products versions listed as affected in the advisory. An update is available that resolves the reported vulnerabilities. AWIN gateways are not intended to be internet-facing. An attacker who successfully exploited this vulnerability could take remote control of the product and reboot the device, potentially causing a denial of service. It can also reveal system specific configuration. ABB requires, as noted in the User Manual, that AWIN gateways should not be exposed to the internet or any other insecure network. Note. | CISA |
| Apr 30, 2026 | CISA | ICS Advisory | ICSA-26-120-06: ABB Ability Symphony Plus Engineering ABB became aware of vulnerability in the products versions listed as affected in the advisory. The ABB S+ Engineering product versions are affected by vulnerabilities in PostgreSQL version 13.11 and earlier versions. If an attacker gains access to a site’s S+ Client Server network, they could exploit such vulnerabilities by executing arbitrary code and potentially compromising the entire system. | CISA |
| Apr 30, 2026 | CISA | ICS Advisory | ICSA-26-120-02: ABB PCM600 An update is available that resolves vulnerability in the product versions listed as affected in this advisory. An attacker who successfully exploited this vulnerability could insert and run arbitrary code in the system. | CISA |
| Apr 30, 2026 | CERT-EU | Advisory | 2026-005: High Vulnerability in the Linux Kernel ("Copy Fail") The vulnerability affects every mainstream Linux distributions shipping a kernel built since 2017. As of the date of this advisory, no distribution has shipped a fixed kernel package. | CERT-EU |
| Apr 29, 2026 | CISA | Advisory | Adapting Zero Trust Principles to Operational Technology Zero trust is a modern, adaptive approach to cybersecurity that eliminates implicit trust and requires continuously validating access based on identity, context, and risk. With advancements in technology, OT systems that were traditionally isolated or manually operated are now increasingly interconnected, digitally monitored, and remotely controlled. | CISA, DOE, FBI |
| Apr 29, 2026 | CISA | Vulnerability Advisory | VA-26-119-01: CryptPad unbounded WebSocket frame flood CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. | CISA |
| Apr 29, 2026 | CISA | Vulnerability Advisory | VA-26-119-02: TP-Link WR841N Router multiple vulnerabilities Multiple TP-Link products (TP-Link Archer C20 V5, Archer C20 6.0, Archer AX53 v1.0 and TL-WR841N v13) are affected by multiple vulnerabilities. The most severe of these vulnerabilities could allow an adjacent, unauthenticated attacker to execute administrative commands. | CISA |
| Apr 28, 2026 | CISA | ICS Advisory | ICSA-26-118-01: NSA GRASSMARLIN Successful exploitation of this vulnerability could allow an attacker to disclose sensitive information. | CISA |
| Apr 27, 2026 | NCSC | Guidance | Could your choice of metrics be harming your SOC? Poor metrics can render a well-intentioned security operation centre entirely ineffective. Security operation centres (SOCs) are a key defence in organisations, where skilled analysts use tools to hunt for attacks in the haystacks of logs. Unsurprisingly, SOCs are usually expensive to run, with costs that include staff, licenses and storage. | NCSC-UK |
| Apr 23, 2026 | CISA | ICS Advisory | ICSA-26-113-05: Hangzhou Xiongmai Technology Co., Ltd XM530 IP Camera Successful exploitation of this vulnerability could allow an attacker to bypass authentication and have remote access to sensitive information on the device. | CISA |
| Apr 23, 2026 | NSA | Advisory | Defending Against China-Nexus Covert Networks of Compromised Devices Over the past few years there has been a major shift in the tactics, techniques and procedures (TTPs) used by China-nexus cyber actors, moving away from the use of individually procured infrastructure, and towards the use of externally provisioned, large-scale networks of compromised devices. | AIVD, ASD/ACSC, BSI, CCCS, CISA, DC3, FBI, MIVD, NCO, NCSC-NZ, NCSC-SE, NCSC-UK, NSA |
| Apr 23, 2026 | CISA | Analysis Report | FIRESTARTER Backdoor Malware Analysis Report at a Glance Malware Name FIRESTARTER Original Publication April 23, 2026 Executive Summary The Cybersecurity and Infrastructure Security Agency (CISA) analyzed a sample of FIRESTARTER malware obtained from a forensic investigation. | CISA, NCSC, NCSC-UK |
| Apr 23, 2026 | NCSC | Guidance | Supporting AI adoption for UK cyber defence Getting there will require time, the development of new capabilities and As the NCSC’s CEO set out in his letter to the Financial Times last week, AI can ultimately be a good thing for cyber security. In the near term, however, AI is likely to expose weaknesses in organisations that have not taken appropriate steps to secure their systems. | NCSC-UK |
| Apr 23, 2026 | NSA | Guidance | International cyber agencies share fresh advice to defend against China-linked covert networks GCHQ’s National Cyber Security Centre with UK industry and 15 international partners shine light on best protections against methods used by China-linked threat actors. Covert networks, often made up of compromised devices such as smart devices, are being used to disguise the origins and attributions of cyber attacks. | AIVD, ASD/ACSC, BSI, CCCS, CISA, DC3, FBI, MIVD, NCO, NCSC-NZ, NCSC-SE, NCSC-UK, NSA |
| Apr 23, 2026 | NCSC | Guidance | NCSC: Leave passwords in the past - passkeys are the future Passkeys are the more secure and user-friendly login method and should be the default authentication option for consumers. | NCSC-UK |
| Apr 23, 2026 | NCSC | Guidance | Passkeys are more secure than traditional ways to log in Passkeys offer a more usable, secure replacement for passwords and are already supported by most modern devices. | NCSC-UK |
| Apr 23, 2026 | CISA | ICS Advisory | ICSA-26-113-06: Intrado 911 Emergency Gateway (EGW) Successful exploitation of this vulnerability could allow an attacker to read, modify, or delete files. | CISA |
| Apr 23, 2026 | CISA | ICS Advisory | ICSA-26-113-04: SpiceJet Online Booking System Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information. | CISA |
| Apr 23, 2026 | CISA | ICS Advisory | ICSA-26-113-03: Milesight Cameras Successful exploitation of these vulnerabilities could crash the device being accessed or allow remote code execution. | CISA |
| Apr 23, 2026 | CISA | ICS Advisory | ICSA-26-113-02: Carlson Software VASCO-B GNSS Receiver Successful exploitation of this vulnerability could enable a remote attacker to alter critical system functions or disrupt device operation. | CISA |
| Apr 23, 2026 | CISA | ICS Advisory | ICSA-26-113-01: Yadea T5 Electric Bicycle Successful exploitation of this vulnerability could result in an attacker being able to unlock and start the bicycle, leading to vehicle theft. | CISA |
| Apr 22, 2026 | NCSC | Guidance | World-first NCSC-engineered device secures vulnerable display links SilentGlass, a plug-and-play device, actively blocks any unexpected or malicious HDMI and Display Port connections. | NCSC-UK |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-11: Siemens Industrial Edge Management Industrial Edge Management contains an authorization bypass vulnerability that could be exploited by an unauthenticated remote attacker to circumvent authentication and to access connected Industrial Edge Devices through the remote connection feature. Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-01: Siemens TPM 2.0 The products listed below contain a vulnerability that could allow an attacker to perform an out-of-bound read, potentially leading to information disclosure or denial of service of the TPM. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-02: Siemens RUGGEDCOM CROSSBOW Secure Access Manager Primary RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) contains a vulnerability that could allow an attacker to escalate their own privileges. Siemens has released a new version for RUGGEDCOM CROSSBOW Secure Access Manager Primary (SAM-P) and recommends to update to the latest version. | CISA |
| Apr 21, 2026 | NCSC | Guidance | New cross domain guidance for government, industry and the wider security community Cross domain technologies play a vital role in helping organisations to move data safely between environments with different security levels. The NCSC know this area can be challenging to navigate, which is why we’ve produced new guidance on Cross domain approach and architecture. | NCSC-UK |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-03: Siemens SINEC NMS Siemens SINEC NMS when used with User Management Component (UMC) contains an authentication bypass vulnerability due to insufficient validation of user identity. This could allow an unauthenticated remote attacker to bypass authentication and gain unauthorized access to the application. Siemens has released a new version for SINEC NMS and recommends to update to the latest version. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-04: Siemens Analytics Toolkit Multiple Siemens applications are affected by improper certificate validation in Siemens Analytics Toolkit. This could allow an unauthenticated remote attacker to perform man in the middle attacks. Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-05: Hardy Barth Salia EV Charge Controller (Update A) Successful exploitation of these vulnerabilities could crash the device being accessed; a buffer overflow condition may allow remote code execution. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-06: Zero Motorcycles Firmware (Update A) Successful exploitation of this vulnerability could allow an attacker to pair via Bluetooth with a motorcycle, gaining unauthorized access to all Bluetooth functions, including changing the firmware. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-07: Siemens SCALANCE SCALANCE W-700 IEEE 802.11n family before V6.6.0 are affected by multiple vulnerabilities. Siemens has released a new version for SCALANCE W-700 IEEE 802.11n family and recommends to update to the latest version. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-08: Siemens RUGGEDCOM CROSSBOW Station Access Controller (SAC) RUGGEDCOM CROSSBOW Station Access Controller (SAC) contains a vulnerability that could allow an attacker to achieve arbitrary code execution and to create a denial of service condition. Siemens has released a new version for RUGGEDCOM CROSSBOW Station Access Controller (SAC) and recommends to update to the latest version. | CISA |
| Apr 21, 2026 | NCSC | Guidance | Cyber chief: UK faces "perfect storm" for cyber security As the technology landscape develops, the definition of cyber security is expanding with it and organisations must grasp Technological change and geopolitical tensions present “tumultuous uncertainty” requiring culture shift in approach to cyber defence, says head of UK cyber agency All organisations urged to follow advice to make cyber security part of their mission, as cyberspace sits in state Threat picture ever more contested, with majority o… | NCSC-UK |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-12: SenseLive X3050 Successful exploitation of these vulnerabilities could allow an attacker to take complete control of the device. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-09: Siemens SINEC NMS SINEC NMS before V4.0 SP3 contains an Authorization Bypass vulnerability that could allow an attacker to bypass authorization checks, leading to the ability to reset the password of any arbitrary user account. Siemens has released a new version for SINEC NMS and recommends to update to the latest version. | CISA |
| Apr 21, 2026 | CISA | ICS Advisory | ICSA-26-111-10: Silex Technology SD-330AC and AMC Manager Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, cause a denial-of-service, or configuration information may be altered without authentication. | CISA |
| Apr 20, 2026 | NCSC | Guidance | Preparing for severe cyber threat: why leaders must act now Disruption to those operations isn’t simply an IT issue; it’s a business continuity and national resilience issue. Recent high-profile cyber incidents demonstrate a clear and accelerating trend: highly capable threat actors are increasing both their intent and their ability to target organisations of national economic significance, to cause real-world operational disruption. | NCSC-UK |
| Apr 20, 2026 | CISA | Alert | Supply Chain Compromise Impacts Axios Node Package Manager The Cybersecurity and Infrastructure Security Agency (CISA) is releasing this alert to provide guidance in response to the software supply chain compromise of the Axios node package manager (npm). 1 Axios is an HTTP client for JavaScript that developers commonly use in Node.js and browser environments. On March 31, 2026, two npm packages for versions [email protected] and [email protected] of Axios npm injected the malicious dependency [email protected]. | CISA |
| Apr 17, 2026 | NCSC | Guidance | Strengthening cyber resilience across the NHS with collaboration and innovation How the NCSC is reducing risk, improving detection, and helping to keep vital services running. We all rely on the UK’s health services, from booking a GP appointment and collecting prescriptions, to receiving life‑saving treatment in hospitals. These services increasingly depend on digital systems to operate safely and effectively. | NCSC-UK |
| Apr 16, 2026 | CISA | ICS Advisory | ICSA-26-106-04: AVEVA Pipeline Simulation Successful exploitation of this vulnerability could allow an unauthenticated attacker to modify simulation parameters, training configuration and training records. | CISA |
| Apr 16, 2026 | CISA | ICS Advisory | ICSA-26-106-03: Anviz Multiple Products Successful exploitation of these vulnerabilities could allow attackers to conduct reconnaissance, capture or decrypt sensitive data, alter device configurations, gain unauthorized administrative or root‑level access, execute arbitrary code, compromise credentials or communications, and ultimately obtain full control over affected devices. | CISA |
| Apr 16, 2026 | CISA | ICS Advisory | ICSA-26-106-02: Horner Automation Cscape and XL4, XL7 PLC Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to systems and services. | CISA |
| Apr 16, 2026 | CISA | ICS Advisory | ICSA-26-106-01: Delta Electronics ASDA-Soft Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. | CISA |
| Apr 15, 2026 | JPCERT/CC | Alert | Microsoft Releases April 2026 Security Updates Microsoft has released April 2026 Security Updates to address the vulnerabilities in their products. Attackers leveraging these vulnerabilities may be able to perform spoofing over a network, or execute arbitrary code remotely without authentication, etc. According to Microsoft, among the vulnerabilities, the following vulnerability has been confirmed to be exploited in the wild. | JPCERT/CC |
| Apr 15, 2026 | JPCERT/CC | Alert | Alert Regarding Vulnerabilities in Adobe Acrobat and Reader (APSB26-44) Vulnerabilities exists in Adobe Acrobat, a PDF file creation and conversion software, and Adobe Acrobat Reader, a PDF file viewing software. As a result, an attacker may execute arbitrary code by convincing a user to open contents leveraging the vulnerability. | JPCERT/CC |
| Apr 15, 2026 | NCSC | Guidance | Retaining defensive advantage in the age of frontier AI cyber capabilities As AI accelerates vulnerability discovery, organisations must raise their security baselines to safeguard their cyber security. | NCSC-UK |
| Apr 9, 2026 | CISA | ICS Advisory | ICSA-26-099-02: GPL Odorizers GPL750 Successful exploitation of this vulnerability could allow a low privileged remote attacker to manipulate register values, which would result in too much or too little odorant being injected into a gas line. | CISA |
| Apr 9, 2026 | CISA | ICS Advisory | ICSA-26-099-01: Contemporary Controls BASC 20T Successful exploitation of this vulnerability could allow an attacker to enumerate the functionality of each component associated with the PLC, reconfigure, rename, delete, perform file transfers, and make remote procedure calls. | CISA |
| Apr 7, 2026 | NSA | Advisory | Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure This activity has led to PLC disruptions across several U.S. critical infrastructure sectors through malicious interactions with the project file and manipulation of data on human machine interface (HMI) and supervisory control and data acquisition (SCADA) displays, resulting in operational disruption and financial loss. U.S. | CISA, CNMF, DOE, EPA, FBI, NIST, NSA |
| Apr 7, 2026 | NCSC | Guidance | UK exposes Russian military intelligence hijacking vulnerable routers for cyber attacks New advisory warns cyber threat group APT28 have exploited vulnerable edge devices to support malicious operations. The National Cyber Security Centre (NCSC) – a part of GCHQ – has published a new advisory revealing how Russian cyber actors have compromised commonly used routers , allowing them to covertly reroute users’ internet traffic through malicious servers under their control. | NCSC-UK |
| Apr 7, 2026 | NCSC | Guidance | APT28 exploit routers to enable DNS hijacking operations Russian cyber actor APT28 exploit vulnerable routers to hijack DNS, enabling adversary‑in‑the‑middle attacks and theft of passwords and authentication tokens. Russian cyber actors APT28 have been exploiting routers to overwrite Dynamic Host Configuration Protocol (DHCP)/Domain Name System (DNS) settings to redirect traffic through attacker-controlled DNS servers. | NCSC-UK |
| Apr 7, 2026 | CISA | ICS Advisory | ICSA-26-097-01: Mitsubishi Electric GENESIS64 and ICONICS Suite products Successful exploitation of these vulnerabilities could allow a local attacker to disclose SQL Server credentials used by the affected products and use them to disclose, tamper with, or destroy data, or to cause a denial-of-service (DoS) condition on the system. | CISA |
| Apr 7, 2026 | CISA | Vulnerability Advisory | VA-26-097-02: IBM Maximo Application Suite Sensitive Tokens without 'Secure' Attribute IBM Maximo Application Suite 9.1, 9.0, 8.11, and 8.10 does not set the secure attribute on authorization tokens or session cookies. An unauthenticated attacker can steal cookies by directing users to a malicious http:// link and snooping user traffic. | CISA |
| Apr 7, 2026 | CISA | Vulnerability Advisory | VA-26-097-01: Thales Sentinel LDK Runtime Stored XSS Thales Sentinel LDK Runtime on Windows allows Stored Cross-site Scripting. | CISA |
| Apr 2, 2026 | CISA | ICS Advisory | ICSA-26-092-03: Hitachi Energy Ellipse Hitachi Energy is aware of a Jasper Report vulnerability that affects the Ellipse product versions mentioned in this document below. This vulnerability can be exploited to carry out remote code execution (RCE) attack on the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation. | CISA |
| Apr 2, 2026 | CISA | ICS Advisory | ICSA-26-092-02: Yokogawa CENTUM VP Successful exploitation of this vulnerability could allow an attacker to login as the PROG user and modify permissions. | CISA |
| Apr 2, 2026 | CISA | ICS Advisory | ICSA-26-092-01: Siemens SICAM 8 Products Multiple SICAM 8 products are affected by multiple vulnerabilities that could lead to denial of service, namely: - SICAM A8000 Device firmware - CPCI85 for CP-8031/CP-8050 - SICORE for CP-8010/CP-8012 - RTUM85 for CP-8010/CP-8012 - SICAM EGS Device firmware - CPCI85 - SICAM S8000 - SICORE - RTUM85 Siemens has released new versions for the affected products and recommends to update to the latest versions. | CISA |
| Apr 2, 2026 | CISA | Vulnerability Advisory | VA-26-092-02: Zscaler Client Connector hard-coded proxy configuration domain Zscaler Client Connector 4.7 and 4.8 on Microsoft Windows misspell a domain that is added by default to an internal bypass list. This could lead to a limited amount of traffic from being inspected under specific circumstances. | CISA |
| Apr 2, 2026 | CISA | Vulnerability Advisory | VA-26-092-01: Bentley Systems iTwin Platform exposed access token Bentley Systems iTwin Platform exposed a Cesium ion access token in the source of some web pages. An unauthenticated attacker could use this token to enumerate or delete certain assets. | CISA |