Johnsoncontrols
Vulnerability activity for Johnsoncontrols: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 10
- Critical (CVSS 9+)
- 7
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.4MediumJul 31, 2026Johnsoncontrols fms employee XSSCVE-2026-34497Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting (XSS). This issue affects FM Systems Employee: before 2025.3.1.
- 5.4MediumJul 31, 2026Johnsoncontrols fms employee XSSCVE-2026-34495Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1.
- 5.5MediumJul 31, 2026Johnsoncontrols xaap Information disclosureCVE-2026-34490Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53.
- 9.8CriticalJul 31, 2026Johnsoncontrols fms employee Path traversal / file handlingCVE-2026-21662Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1.
- 9.8CriticalFeb 27, 2026Johnsoncontrols frick controls quantum hd firmware Information disclosureCVE-2026-21660A Hardcoded Email Credentials Saved as Plaintext in Firmware (CWE-256: Plaintext Storage of a Password) vulnerability in Frick Controls Quantum HD version 10.22 and prior lead to unauthorized access, exposure of sensitive information, and potential misuse or system compromise This issue affects Frick Controls Quantum HD version 10.22 and prior.
- 9.8CriticalFeb 27, 2026Johnsoncontrols frick controls quantum hd firmware Path traversal / file handlingCVE-2026-21659Unauthenticated Remote Code Execution and Information Disclosure due to Local File Inclusion (LFI) vulnerability in Johnson Controls Frick Controls Quantum HD allow an unauthenticated attacker to execute arbitrary code on the affected device, leading to full system compromise. This issue affects Frick Controls Quantum HD: Frick Controls Quantum HD version 10.22 and prior.1% likely
- 9.8CriticalFeb 27, 2026Johnsoncontrols frick controls quantum hd firmware Code / command injectionCVE-2026-21658Unauthenticated Remote Code Execution i.e Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
- 9.8CriticalFeb 27, 2026Johnsoncontrols frick controls quantum hd firmware Code / command injectionCVE-2026-21657Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
- 9.8CriticalFeb 27, 2026Johnsoncontrols frick controls quantum hd firmware Code / command injectionCVE-2026-21656Improper Control of Generation of Code ('Code Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows Code Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
- 9.8CriticalFeb 27, 2026Johnsoncontrols frick controls quantum hd firmware Code / command injectionCVE-2026-21654Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.1.7% likely
Top products
- frick controls quantum hd firmware6 CVEs in the last year, 6 critical
- fms employee3 CVEs in the last year, 1 critical
- xaap1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.