Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 31

Export CSV
CVE-2026-21661

AC2000 Uncontrolled Search Path Element

An Uncontrolled Search Path Element vulnerability in JohnsonControls AC2000 on Windows allows Leveraging/Manipulating Configuration File Search Paths. This issue affects AC2000: from 10.6 before release 10, from 11.0 before release 9, from 12 before release 3.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Ac2000 Ac2000
CVE-2026-27875

Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Simplex Incident Manager Autocall Fire Administrator Simplex Incident Manager / Autocall Fire Administrator
CVE-2026-27871

TL280

Cwe-327 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Johnson Controls TL280 allows Cryptanalytic Attack. This issue affects TL280: before 5.63.

CVSS 4.0 · 2.9 Low EPSS < 1% KEV · Not listed
Vendors
Johnson Controls
Products
Tl280
CVE-2026-21655

C-CURE 9000 and Victor application server - Deserialization of Untrusted Data

Deserialization of untrusted data vulnerability in Johnson Control victor on Windows, Johnson Controls CCure 9000, and Johnson Controls Victor Application Server allows capec-586. This issue affects victor: before 8.0; CCure 9000: before 3.2; Victor Application Server: before 4.1.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Johnson Control Johnson Controls Johnsoncontrols
Products
Victor Ccure 9000 Victor Application Server and 1 more
CVE-2026-34490

XAAP Android Data Stored in Unencrypted Database

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Xaap Application Xaap Xaap Application