Solution sectors / ics-ot-iot
ICS, OT & IoT
Industrial control systems, operational technology and IoT devices bridge the physical and digital worlds, where a vulnerability can have real-world consequences. This hub tracks CVEs across ICS, OT and connected devices.
smart-home · 14industrial-network · 10ip-camera-nvr · 3medical-device · 2building-automation · 1plc-scada-hmi
Cumulative CVEs
12,247
across 232 monthly snapshots
Latest month
78 · proj
-60.2% MoM · -38.1% YoY
Peak month
310
Dec 25
KEV this month
0
16 vendors affected
CVEs per month
Newest period on the right. Click a point to open that monthly report.
Deployment mix
How this sector's software is typically delivered (month in progress) — whether you patch it yourself or a vendor does. AI-assisted vendor classification.
- On-prem59%
- Mixed29%
- Embedded12%
Latest CVEs in this sector
The 15 most recently published vulnerabilities tagged to ICS, OT & IoT.
- CVE-2026-19657ScadaLTS Unauthenticated Reflected XSS6.1
- CVE-2026-19656ScadaLTS Authenticated Remote Code Execution9.9
- CVE-2025-41771SQL injection4.3
- CVE-2025-41770Unauthenticated Denial of Service7.5
- CVE-2025-41769Unauthenticated Buffer Overflow in PROFINET Service9.8
- CVE-2026-69109A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of us...7.5
- CVE-2026-69108A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.1). The affected application is vulnerable to a local privilege escalation due to an insecure sudoers policy. ...6.0
- CVE-2026-59701A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files....7.8
- CVE-2026-59700A vulnerability has been identified in Simcenter Femap (All versions < V2606.0001). The affected applications contains an out of bounds read vulnerability while parsing specially crafted BMP files....7.8
- CVE-2026-59693A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.233.16-7862), Desigo PXC3 (All versions < V01.21.233.16-7862), Desigo PXC4 (All versions < V02.21.194.36-2715), Desigo PXC5...4.3
- CVE-2026-59086A vulnerability has been identified in Simcenter Nastran (All versions < V2606). The affected applications contain a stack overflow vulnerability while parsing specially strings as argument for one...7.8
- CVE-2026-57263A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). The project password feature in the affected products stores the password as an unsalted SHA-256 hash. This could allo...6.8
- CVE-2026-57262A vulnerability has been identified in LOGO! Soft Comfort (All versions < V9). Affected products use a static, hardcoded AES master key to encrypt project files. This could allow a local attacker t...6.8
- CVE-2026-50064A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds w...7.8
- CVE-2026-50063A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 15), Solid Edge SE2026 (All versions < V226.0 Update 7). The affected applications contains an out of bounds r...7.8
Weakness fingerprint
Top CWE classes in this sector, latest monthly snapshot (month in progress).
Top vendors
Most CVEs in this sector, latest monthly snapshot (month in progress).
| Vendor | CVEs | Crit | KEV |
|---|---|---|---|
| hkuds | 5 | 1 | · |
| geovision inc. | 3 | 2 | · |
| home-assistant | 3 | · | · |
| mz automation | 3 | · | · |
| domoticz | 2 | · | · |
| esphome | 2 | · | · |
| havelsan | 2 | · | · |
Subsectors
Breakdown for the latest monthly snapshot (month in progress).
| Subsector | CVEs | Crit | KEV | Vendors | MoM | Top products |
|---|---|---|---|---|---|---|
| smart-home | 14 | 2 | · | 6 | — | nanobot (4) · core (3) · domoticz (2) |
| industrial-network | 10 | · | · | 6 | — | libiec61850 (3) · liman mys (2) · visual integrated command and dispatch platform (2) |
| ip-camera-nvr | 3 | 2 | · | 1 | — | gv-as1620 (as-manager) (1) · gv-as1620 (gv-cloud) (1) · gv-asmanager (1) |
| medical-device | 2 | · | · | 2 | — | pilos (1) · radiant dicom (1) |
| building-automation | 1 | · | · | 1 | — | telefunken te24553b45v2dz smart tv (1) |
Sector classification is AI-assisted with human review. How tagging works · Report a misclassification