By year
18
19
20
21
22
23
24
25
26
Bars are flaws published each year; the red part is the share attackers have used.
Latest high and critical flaws
- CVE-2026-71456 Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto Attack.High 8.5 · Oct 26, 2026
- CVE-2026-34499 Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable.High 8.5 · Oct 7, 2026
- CVE-2026-71452 - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.High 7.2 · Oct 1, 2026
- CVE-2026-71449 : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data.Critical 9.3 · Oct 1, 2026
- CVE-2026-64893 - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.High 7.3 · Oct 1, 2026
- CVE-2026-34494 - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations.High 7.2 · Oct 1, 2026
- CVE-2026-34493 - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations.High 7.2 · Oct 1, 2026
- CVE-2026-64887 Use of hard-coded cryptographic key vulnerability in Johnson Controls Airwall allows : Cryptanalytic Attack.High 7 · Aug 14, 2026
- CVE-2026-34492 External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation.High 7 · Aug 14, 2026
- CVE-2026-34496 Cwe-269 vulnerability in Johnson Controls victor Web on Windows allows capec-233.High 7.1 · Jul 23, 2026
- CVE-2026-21653 Victor SSRF vulnerability in Johnson Controls CCure 9000 and victor application server allows Server Side Request Forgery.High 7.2 · Jul 23, 2026
- CVE-2026-21661 An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths.High 8.4 · May 6, 2026
- CVE-2026-21659 Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD aHigh 8.7 · Feb 27, 2026
- CVE-2026-21658 Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD High 8.8 · Feb 27, 2026
- CVE-2026-21657 Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection.High 8.8 · Feb 27, 2026
- CVE-2026-21656 Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection.High 8.8 · Feb 27, 2026
- CVE-2026-21654 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OSHigh 8.8 · Feb 27, 2026
- CVE-2025-26385 Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability .Critical 9.5 · Jan 30, 2026
- CVE-2025-26386 Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability.High 7.1 · Jan 28, 2026
- CVE-2025-43876 Under certain circumstances a successful exploitation could result in access to the device.High 8.7 · Dec 24, 2025
- CVE-2025-43875 Under certain circumstances a successful exploitation could result in access to the device.High 8.7 · Dec 24, 2025
- CVE-2025-61740 Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configuratiHigh 7.2 · Dec 22, 2025
- CVE-2025-26379 Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.High 7.2 · Dec 22, 2025
- CVE-2025-61739 Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.High 7.2 · Dec 22, 2025
- CVE-2025-61736 Successful exploitation of this vulnerability could result in the product failing to re-establish communication once the certificate expires.High 7.1 · Dec 17, 2025
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.