What you need to know today.
MikroTik and VMware flaws, alongside multiple Remix Run React Router vulnerabilities, lead CISA advisories for ICS components.
MikroTik RouterOS and Cloud Hosted Router are affected by a weakness in API authentication handling that lacks effective safeguards against excessive login attempts. The system does not enforce meaningful rate-limiting, account lockout, or source-based restrictions, potentially allowing attackers to brute-force credentials. This vulnerability, detailed in CISA ICS Advisory ICSA-26-209-05, could lead to unauthorized access to network devices. CVE-2026-16347 is a high-severity flaw with a CVSS score of 8.8.
VMware's VeloCloud Orchestrator contains a blind SQL-injection vulnerability due to improper input validation. A malicious actor with tenant access can craft SQL queries to exfiltrate sensitive data. This high-severity vulnerability (CVE-2020-3973, CVSS 8.8) poses a significant risk to data confidentiality.
Several vulnerabilities have been disclosed affecting Remix Run's React Router. CVE-2026-53668 and CVE-2026-53669 relate to open redirects, with the former exploiting XSS via open redirects and the latter using backslashes in navigation components. CVE-2026-53667 addresses untrusted redirects due to missing protocol validation, and CVE-2026-53666 allows information disclosure via client-side constructor execution. These moderate-severity issues collectively present risks of cross-site scripting, unauthorized redirection, and data leakage.
Siemens SIMATIC S7-PLCSIM Advanced and other devices are vulnerable to a denial-of-service condition caused by improper handling of high-volume multicast traffic, which can exhaust memory resources. An unauthenticated local attacker could exploit this to cause a denial of service, as noted in CISA ICS Advisory ICSA-26-209-03. This high-severity flaw is tracked as CVE-2026-54429.
Igloohome Smart Lock Mobile App versions prior to 3.2.3 contain an "Inclusion of Sensitive Information in Source Code" vulnerability. Unauthorized actors could exploit this to access inadequately protected functions or backend services. This moderate-severity issue is detailed in CISA ICS Advisory ICSA-26-209-06 and assigned CVE-2026-16581.
ABB KNX Update Tool is affected by a vulnerability where the integrity of the firmware image is not protected, exclusively impacting legacy KNX products. This medium-severity flaw, CVE-2026-12705, is documented in CISA ICS Advisory ICSA-26-209-07.
Other vulnerabilities include a weakness in eda-server's ExternalEventStreamViewSet trusting the Subject header without validation, potentially leaking DN information (CVE-2026-12383). Moodle has a CSRF risk in group messaging state toggle (CVE-2026-58341). Gstreamer has a 4-byte heap over-read in gst_matroska_parse_flac_stream_headers (CVE-2026-17072). Apache Thrift Python bindings have an improper validation of certificate with host mismatch issue (CVE-2026-66053). GIMP has several flaws in its file-icns, file-sgi, and file-fits plugins related to buffer overflows and memory allocation issues (CVE-2026-66759, CVE-2026-66757, CVE-2026-66758). HDF5 contains multiple vulnerabilities including NULL pointer dereference, double free, and heap-based buffer overflow (CVE-2026-17574, CVE-2026-17573, CVE-2026-17572). The JavaScript library ip-address is vulnerable to SSRF through misclassification of IPv4-mapped/NAT64 IPv6 addresses (CVE-2026-54272).