Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Tuesday 3 November
Global

Your region, kept on this device.

Get the appSign in

Siemens

Company

Security timeline

  1. Vulnerability reported by The Register (Security)Maximum-severity Node-RED flaw CVE-2026-58115 exploited to deliver Linux bot
  2. Zero-day reported by watchTowr LabsCISA adds VMware ESX CVE-2026-41709 and Linux Fragnesia to KEV; China-linked Warp Panda exploited ESX flaw

Recent news

The Register (Security)· · Critical

Maximum-severity Node-RED flaw CVE-2026-58115 exploited to deliver Linux bot

CVE-2026-58115, rated 10 out of 10 on CVSS, affects Node-RED, including SIMATIC IoT2050 devices, where the HTTP interface does not enforce authentication. Unauthenticated attackers can deploy a malicious flow that runs shell commands as soon as it is deployed. VulnCheck observed one IP address target the flaw 16 times between 30 October and 1 November, with one payload pointing to a separate server that hosts a Linux bot.

Am I affected?
Ask
1
watchTowr Labs· · High

CISA adds VMware ESX CVE-2026-41709 and Linux Fragnesia to KEV; China-linked Warp Panda exploited ESX flaw

CISA added VMware ESX CVE-2026-41709 (insufficient logging, CVSS 7.6) and CVE-2026-46300 (Fragnesia) to its KEV catalogue. reports that Warp Panda exploited the ESX flaw as a zero-day in early 2026 to reduce audit log visibility. The Cyber Centre also flagged exploitation of a Siemens Software Center DLL sideloading flaw and Gitea vulnerabilities, and urged administrators to apply updates.

Am I affected?
Ask
36