For Part 2 we have 12 additional vendor disclosures from Hitachi Energy (3), JUMO, MB connect (2), METTLER TOLEDO, Moxa, NI, Phoenix Contact, and QNAP (2).
Hitachi Energy Advisories
Hitachi Energy published an advisory that discusses two vulnerabilities in their ITT600 Explorer product. These are third-party (LibExpat) vulnerabilities. Hitachi Energy has new versions that mitigate the vulnerabilities.
The two reported vulnerabilities are:
Uncontrolled recursion - CVE-2024-8176,
Allocation of resources without limit or throttling - CVE-2025-59375 (exploit)
Hitachi Energy published an advisory that describes a heap-based buffer overflow vulnerability in their MACH HiDraw product. Hitachi Energy has a new version that mitigates the vulnerability.
Hitachi Energy published an advisory that describes four vulnerabilities in their RTU500 product. Two of the vulnerabilities are third-party vulnerabilities. Hitachi Energy has new versions that mitigate the vulnerabilities.
The four reported vulnerabilities are:
Uncontrolled recursion - CVE-2024-8176,
Allocation of resources without limit or throttling - CVE-2025-59375 (exploit)
Improper handling of insufficient permissions or privileges - CVE-2026-1772, and
Incomplete list of disallowed inputs - CVE-2026-1773.
JUMO Advisory
CERT-VDE published an advisory that discusses an improper input validation vulnerability in multiple JUMO products. This is a third-party (qs) vulnerability; the report includes proof-of-concept code. JUMO has a new version that mitigates the vulnerability.
MB connect Advisory
MB connect published an advisory that describes an SQL injection vulnerability in their mbCONNECT24 and mymbCONNECT24 products. MB connect has a new version that mitigates the vulnerability.
NOTE: This advisory covers 41 separate potential SQL injection instances under a single CVE. A CERT-VDE advisory lists each SQL injection instance as a separate CVE.
MB connect published an advisory that describes two vulnerabilities in in their mbNET/mbNET.rokey and mbNET.mini products. MB connect has new versions that mitigate the vulnerabilities.
The two reported vulnerabilities are:
Improper validation of specified type of input - CVE-2026-40851, and
OS command injection - CVE-2026-40852.
METTLER TOLEDO Advisory
CERT-VDE published an advisory that discusses two vulnerabilities in their EVA Karl Fischer titrator software. These are third-party (libpng) vulnerabilities. METTLER TOLEDO has new versions that mitigate the vulnerabilities.
The two reported vulnerabilities are:
Out-of-bounds read - CVE-2026-33636, and
Use after free - CVE-2026-33416 (exploit).
Moxa Advisory
Moxa published an advisory that discusses the Copy Fail and Dirty Frag vulnerabilities. Moxa provides a list of affected products and generic mitigation measures pending development of a fix.
NI Advisory
NI published an advisory that describes a missing authentication for critical function vulnerability in their SystemLink Enterprise product. NI has a new version that mitigates the vulnerability.
Phoenix Contact Advisory
Phoenix Contact published an advisory that describes two vulnerabilities in their PLCnext firmware. The vulnerabilities were reported by Diego Giubertoni of Nozomi Networks. Phoenix Contact has a new firmware version that mitigates the vulnerability.
The two reported vulnerabilities are:
Uncontrolled search path element - CVE-2025-41670, and
Improper verification of cryptographic signature - CVE-2025-41669.
QNAP Advisories
QNAP published an advisory that discusses the Dirty Frag vulnerabilities. QNAP provides lists of affected and not affected products. QNAP has new versions that mitigate the vulnerabilities.
QNAP published an advisory that discusses the Copy Fail vulnerability. QNAP provides lists of affected and not affected products. QNAP has new versions that mitigate the vulnerability.