CVE-2026-22904 is a critical stack-based buffer overflow vulnerability in the WAGO 0852-1322 device caused by improper length handling when parsing multiple cookie fields, including TRACKID. An unauthenticated remote attacker can exploit this by sending oversized cookie values, leading to denial-of-service or potential remote code execution. The vulnerability has a CVSS score of 9.8, indicating high severity with no authentication or user interaction required. No known exploits are currently reported in the wild. European organizations using WAGO 0852-1322 controllers, especially in industrial automation sectors, are at significant risk. Mitigation requires immediate vendor patching once available and network-level protections to restrict access to affected devices. Countries with strong industrial automation presence such as Germany, France, and Italy are most likely to be impacted.
CVE-2026-22903 is a critical stack-based buffer overflow vulnerability in the WAGO 0852-1322 device's modified lighttpd server. An unauthenticated remote attacker can exploit this by sending an HTTP request with an excessively long SESSIONID cookie, causing the server to crash and potentially allowing remote code execution. The vulnerability arises due to missing stack protections, making exploitation easier and more impactful. This flaw affects the availability, integrity, and confidentiality of the device and connected systems. No patches are currently available, and no known exploits are reported in the wild yet. European organizations using WAGO 0852-1322 devices, especially in industrial automation and control systems, are at high risk. Mitigation requires network-level protections, strict input validation, and monitoring for anomalous HTTP requests. Countries with significant industrial automation sectors and WAGO market presence, such as Germany, France, and the Netherlands, are most likely to be affected. Given the critical CVSS score of 9.8, immediate attention and proactive defense measures are essential to prevent exploitation.
CVE-2026-2235 is a high-severity SQL Injection vulnerability in the HGiga C&Cm@il package olln-base component. It allows authenticated remote attackers to inject arbitrary SQL commands, potentially exposing sensitive database contents. The vulnerability requires low privileges and no user interaction, making exploitation relatively straightforward once authenticated. Although no public exploits are currently known, the impact on confidentiality is high due to possible unauthorized data disclosure. The vulnerability affects version 0 of the product, with no patches currently available. European organizations using this software, especially in countries with higher adoption of HGiga products or critical communication infrastructure, face significant risk. Mitigation involves restricting access to authenticated users, implementing strict input validation, and monitoring database queries for anomalies. Countries with notable HGiga market presence and strategic communication sectors, such as Germany, France, and the UK, are most likely to be affected. Given the ease of exploitation and potential data exposure, this vulnerability demands prompt attention and remediation efforts.
CVE-2026-0870 is a high-severity local privilege escalation vulnerability in GIGABYTE's MacroHub application. The flaw arises because MacroHub launches external applications with excessive privileges, allowing an authenticated local attacker to execute arbitrary code with SYSTEM-level privileges. This vulnerability requires local access and no user interaction, but only low complexity to exploit. Although no known exploits are currently reported in the wild, the impact on confidentiality, integrity, and availability is high due to SYSTEM-level code execution. European organizations using GIGABYTE hardware with MacroHub installed could be at risk, especially in sectors with high reliance on GIGABYTE products. Mitigation involves applying patches once available, restricting local user permissions, and monitoring for suspicious local activity. Countries with significant GIGABYTE market penetration and critical infrastructure sectors, such as Germany, France, and the UK, are most likely affected. Defenders should prioritize vulnerability scanning and restrict local access to trusted users to reduce risk.
CVE-2026-22613 is a medium severity vulnerability affecting Eaton Network M3 devices, caused by improper certificate validation during firmware upgrades via command shell. This flaw allows an attacker with high privileges and requiring user interaction to potentially conduct a man-in-the-middle (MitM) attack, compromising confidentiality and partially impacting integrity and availability. The vulnerability arises from insecure server identity checks, enabling interception or manipulation of firmware upgrade processes. Eaton has addressed this issue in the latest firmware version available on their download center. European organizations using Eaton Network M3 devices should prioritize updating to the patched firmware to mitigate risks. The vulnerability is remotely exploitable with low attack complexity but requires privileged access and user interaction. Countries with significant industrial and critical infrastructure sectors relying on Eaton products, such as Germany, France, and the UK, are most likely to be impacted. Mitigation involves applying the firmware update, restricting access to command shell interfaces, and monitoring network traffic for suspicious activity during firmware upgrades.
CVE-2025-66594 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw involves detailed error messages that expose sensitive information, which attackers could leverage to facilitate further attacks. The vulnerability requires no authentication or user interaction and can be exploited remotely over the network. Although no known exploits are currently in the wild, the information disclosure risk could aid attackers in reconnaissance or crafting targeted attacks. European organizations using FAST/TOOLS in critical industrial control systems may face increased risk, particularly in countries with significant industrial automation sectors. Mitigation involves restricting error message detail exposure, applying vendor patches when available, and implementing network segmentation and monitoring. Countries like Germany, France, Italy, and the UK are likely most affected due to their industrial base and usage of such control systems.
CVE-2025-66597 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the use of weak cryptographic algorithms, which can allow attackers to decrypt communications between clients and the web server. This vulnerability requires no authentication or user interaction and can be exploited remotely over the network. While no known exploits are currently in the wild, the weakness poses a significant risk to confidentiality and potentially integrity of data transmitted. European organizations using FAST/TOOLS in critical industrial control or monitoring environments could face data exposure or interception risks. Mitigation involves upgrading to patched versions once available or applying compensating controls such as network segmentation and encrypted tunnels. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected. Due to the critical nature of industrial control systems, this vulnerability demands prompt attention to prevent potential espionage or sabotage.
CVE-2025-66598 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue arises from the product's support for outdated SSL/TLS protocols, which use broken or risky cryptographic algorithms (CWE-327). This flaw potentially allows attackers to decrypt communications between clients and the web server, compromising confidentiality. The vulnerability requires no user interaction and can be exploited remotely without authentication, increasing its risk. Although no known exploits are currently active in the wild, the vulnerability's presence in critical industrial control system software raises significant concerns. European organizations using FAST/TOOLS in sectors like energy, manufacturing, and utilities are at risk. Mitigation involves disabling legacy SSL/TLS versions, applying vendor patches once available, and implementing network-level protections. Countries with substantial industrial automation deployments, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2025-66600 is a high-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 through R10.04. The issue stems from the lack of HTTP Strict Transport Security (HSTS) configuration, which exposes communications to interception via man-in-the-middle (MITM) attacks. This vulnerability allows attackers to sniff sensitive data transmitted between clients and the web server. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Although no known exploits are currently in the wild, the vulnerability poses a significant risk to confidentiality. European organizations using FAST/TOOLS in critical industrial control or SCADA environments could face data breaches or operational disruptions. Mitigation involves enabling HSTS on the web server, enforcing HTTPS connections, and monitoring network traffic for suspicious activity. Countries with substantial industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be affected.
CVE-2025-66601 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw arises because the product does not specify MIME types, enabling attackers to perform content sniffing attacks that could lead to execution of malicious scripts. This vulnerability does not require authentication or user interaction but has limited impact on confidentiality and integrity. No known exploits are currently in the wild. European organizations using FAST/TOOLS in critical industrial control systems could face risks of unauthorized script execution, potentially disrupting operations or enabling further attacks. Mitigation involves applying vendor patches when available, enforcing strict content-type headers via web server configurations, and network segmentation of affected systems. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, Italy, and the UK, are most likely to be impacted.
CVE-2025-66607 is a medium-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The flaw involves an insecure setting in the HTTP response header that could allow attackers to redirect users to malicious websites. Exploitation requires no authentication or user interaction but has a high attack complexity. The vulnerability affects multiple FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. Although no known exploits are currently reported in the wild, the issue poses a risk to the integrity of user navigation and could facilitate phishing or malware delivery. European organizations using FAST/TOOLS in critical industrial control systems should prioritize patching or mitigating this vulnerability. Countries with significant industrial automation sectors and Yokogawa customer bases, such as Germany, France, and the UK, are most likely to be impacted. Mitigation involves careful configuration of HTTP headers, monitoring for suspicious redirects, and applying vendor patches once available.
CVE-2025-66606 is a low-severity vulnerability in Yokogawa Electric Corporation's FAST/TOOLS software versions R9.01 to R10.04. The issue stems from improper URL encoding, which could allow an attacker to tamper with web pages or execute malicious scripts via crafted URLs. Exploitation requires user interaction and has a low impact on confidentiality, with no authentication needed but high attack complexity. No known exploits are currently reported in the wild. The vulnerability affects several FAST/TOOLS packages including RVSVRN, UNSVRN, HMIWEB, FTEES, and HMIMOB. European organizations using these versions in industrial control or monitoring environments should be aware but face limited risk due to the low severity and complexity. Mitigation involves applying vendor patches once available, implementing strict input validation, and restricting access to the affected web interfaces. Countries with significant industrial automation sectors using Yokogawa products, such as Germany, France, Italy, and the UK, are more likely to be impacted.
The KRVTZ-NET IDS alerts from February 9, 2026, report reconnaissance and scanning activities targeting network infrastructure, especially Fortigate VPN devices and submission services. The activity includes brute force attempts from IP 152.32.151.39 and exploitation attempts of CVE-2023-27997 from IP 2001:470:1:332::148. Some attackers use Google Webcrawler user-agent spoofing to evade detection. No active exploitation or ransomware campaigns are currently reported, but these reconnaissance actions could lead to more serious attacks. European organizations using Fortigate VPNs are particularly at risk. The threat is assessed as low severity but could impact confidentiality and integrity if unmitigated. Recommended mitigations include proactive patching, enhanced monitoring, multi-factor authentication, and network segmentation.
Edge devices that are no longer supported have been targeted in attacks by state-sponsored hackers, the US says. The post Organizations Urged to Replace Discontinued Edge Devices appeared first on SecurityWeek .
The KRVTZ-NET IDS alerts from February 7, 2026, report low-severity reconnaissance activity detected by network intrusion detection systems. The alerts involve IP addresses associated with known web crawling and scanning entities such as the Naver Webcrawler and Censys scanning platform. This activity is categorized as OSINT and network reconnaissance, indicating automated scanning rather than active exploitation or attacks. No specific vulnerabilities, affected products, or known exploits are linked to these alerts. Although reconnaissance is a common precursor to cyberattacks, the detected activity itself poses minimal immediate risk to confidentiality, integrity, or availability. European organizations, especially those with public-facing services, may observe such scanning as routine internet background noise. Mitigation should focus on reducing exposure and improving detection rather than patching. Countries like Germany, France, the United Kingdom, the Netherlands, and Sweden are most likely to be affected due to their technological infrastructure and historical targeting patterns. Overall, this represents a low-severity threat requiring vigilance but no urgent remediation.
Potential breach at Flickr exposes usernames, email addresses, IP addresses, and activity data. The post Flickr Security Incident Tied to Third-Party Email System appeared first on SecurityWeek .
