The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Transportation
Breach intelligence, attack campaigns, and threat reports targeting the Transportation sector.
Explore Other Sectors
Transportation Threat Reports
Critical WebSocket Vulnerabilities in SWITCH EV's Platform Threaten EV Infrastructure Security
In February 2026, multiple critical vulnerabilities were identified in SWITCH EV's swtchenergy.com platform, affecting all versions. These vulnerabilities include missing authentication for critical functions (CVE-2026-27767), improper restriction of excessive authentication attempts (CVE-2026-25113), insufficient session expiration (CVE-2026-25778), and insufficiently protected credentials (CVE-2026-27773). Exploitation of these flaws could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic, and manipulate data sent to the backend, potentially leading to large-scale denial of service and unauthorized control over charging infrastructure. ([cvedetails.com](https://www.cvedetails.com/cve/CVE-2026-27767/?utm_source=openai)) The increasing reliance on electric vehicle (EV) infrastructure underscores the critical need for robust cybersecurity measures. These vulnerabilities highlight the potential risks associated with inadequate authentication and session management in critical infrastructure systems, emphasizing the importance of implementing comprehensive security protocols to safeguard against such threats.
7 months ago
Kill Chain
EV2GO 2026 Authentication Vulnerabilities: A Wake-Up Call for Critical Infrastructure Security
In February 2026, multiple critical vulnerabilities were identified in EV2GO's ev2go.io charging management platform, affecting all versions. These flaws include missing authentication for critical functions (CVE-2026-24731), improper restriction of excessive authentication attempts (CVE-2026-25945), insufficient session expiration (CVE-2026-20895), and insufficiently protected credentials (CVE-2026-22890). Exploitation could allow attackers to impersonate charging stations, hijack sessions, misroute traffic causing large-scale denial of service, and manipulate backend data. ([therealistjuggernaut.com](https://therealistjuggernaut.com/2026/02/26/trj-cybersecurity-ev2go-charging-platform-exposed-authentication-failures-create-high-risk-entry-points-across-global-ev-infrastructure/?utm_source=openai)) The absence of vendor response and lack of available patches heighten the urgency for organizations to implement immediate defensive measures. This incident underscores the critical need for robust authentication mechanisms and proactive vulnerability management in infrastructure systems to prevent potential exploitation and operational disruptions.
7 months ago
Kill Chain
EV Energy's 2026 Security Flaws: A Wake-Up Call for EV Infrastructure
In February 2026, multiple critical vulnerabilities were identified in EV Energy's ev.energy platform, a UK-based provider of electric vehicle charging software. These vulnerabilities include missing authentication for critical functions (CVE-2026-27772), improper restriction of excessive authentication attempts (CVE-2026-24445), insufficient session expiration (CVE-2026-26290), and insufficiently protected credentials (CVE-2026-25774). Exploitation of these flaws could allow attackers to gain unauthorized control over charging stations, disrupt services, and compromise data integrity. ([beyondmachines.net](https://beyondmachines.net/event_details/critical-vulnerabilities-in-ev-energy-charging-platform-allow-remote-hijacking-b-x-t-d-l?utm_source=openai)) The increasing integration of electric vehicle infrastructure with the power grid underscores the urgency of addressing these security gaps. As cyberattacks on EV charging stations rise, ensuring robust authentication and session management mechanisms is critical to prevent potential disruptions and maintain trust in the EV ecosystem. ([yahoo.com](https://www.yahoo.com/news/cyberattacks-ev-charging-stations-rise-120000365.html?utm_source=openai))
7 months ago
Kill Chain
Critical Vulnerabilities in CloudCharge's Platform Threaten Global EV Charging Networks
In February 2026, multiple critical vulnerabilities were identified in CloudCharge's cloudcharge.se platform, which manages electric vehicle (EV) charging infrastructure globally. These vulnerabilities include missing authentication for critical functions (CVE-2026-20781), improper restriction of excessive authentication attempts (CVE-2026-25114), insufficient session expiration (CVE-2026-27652), and insufficiently protected credentials (CVE-2026-20733). Exploitation of these flaws could allow attackers to impersonate charging stations, hijack sessions, suppress or misroute legitimate traffic, and manipulate data sent to the backend, potentially leading to large-scale denial of service and unauthorized control over charging infrastructure. ([therealistjuggernaut.com](https://therealistjuggernaut.com/2026/02/26/trj-cybersecurity-cloudcharge-platform-vulnerabilities-open-global-ev-charging-networks-to-session-hijack-and-impersonation-risk/?utm_source=openai)) The discovery of these vulnerabilities underscores the urgent need for robust authentication and session management mechanisms in critical infrastructure systems. As the adoption of EVs continues to rise, ensuring the security of charging networks is paramount to prevent potential disruptions and maintain public trust in these technologies.
7 months ago
Kill Chain
Critical Security Flaws in Mobility46's EV Charging Platform Expose Infrastructure to Unauthorized Access
In February 2026, multiple critical vulnerabilities were identified in Mobility46's charging station management platform, mobility46.se. These vulnerabilities include missing authentication for critical functions (CVE-2026-27028), improper restriction of excessive authentication attempts (CVE-2026-26305), insufficient session expiration (CVE-2026-27647), and insufficiently protected credentials (CVE-2026-22878). Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-27028?utm_source=openai)) The increasing reliance on electric vehicle (EV) infrastructure underscores the importance of securing such platforms. These vulnerabilities highlight the need for robust authentication mechanisms and session management to prevent unauthorized access and ensure the integrity of critical infrastructure services.
7 months ago
Kill Chain
Critical Vulnerability in Pelco Sarix Pro 3 Series IP Cameras: Immediate Action Required
In February 2026, a critical authentication bypass vulnerability (CVE-2026-1241) was identified in Pelco, Inc.'s Sarix Pro 3 Series IP Cameras, affecting firmware versions up to 02.52. This flaw allows unauthorized access to the cameras' web management interface, enabling attackers to view live video streams and potentially manipulate device settings without proper authentication. The vulnerability poses significant privacy risks and operational challenges for organizations utilizing these surveillance systems. The incident underscores the growing threat landscape targeting IoT devices, particularly in critical infrastructure sectors such as commercial facilities, defense, energy, healthcare, and transportation. As cyber adversaries increasingly exploit vulnerabilities in connected devices, it is imperative for organizations to prioritize regular firmware updates, implement robust access controls, and conduct comprehensive security assessments to mitigate potential risks.
7 months ago
Kill Chain
Critical Security Flaws in Chargemap's EV Charging Platform Uncovered
In February 2026, multiple critical vulnerabilities were identified in Chargemap's platform, a widely used electric vehicle charging service. These flaws include missing authentication for critical functions (CVE-2026-25851), improper restriction of excessive authentication attempts (CVE-2026-20792), insufficient session expiration (CVE-2026-25711), and insufficiently protected credentials (CVE-2026-20791). Exploitation of these vulnerabilities could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([beyondmachines.net](https://beyondmachines.net/event_details/multiple-vulnerabilities-discovered-in-chargemap-platform-z-y-h-q-j?utm_source=openai)) The absence of vendor patches and Chargemap's lack of response to coordination requests from CISA highlight the urgency for organizations to implement immediate mitigations. This incident underscores the critical need for robust security measures in EV charging infrastructure, especially as the adoption of electric vehicles continues to rise globally. ([beyondmachines.net](https://beyondmachines.net/event_details/multiple-vulnerabilities-discovered-in-chargemap-platform-z-y-h-q-j?utm_source=openai))
7 months ago
Kill Chain
Diesel Vortex Phishing Attack Targets Freight and Logistics Sector in 2025
In late 2025, a cybercriminal group known as 'Diesel Vortex' orchestrated a sophisticated phishing campaign targeting freight and logistics companies across the United States and Europe. Utilizing 52 deceptive domains, the attackers impersonated legitimate platforms such as DAT Truckstop, TIMOCOM, and Penske Logistics to harvest credentials from industry professionals. The campaign led to the compromise of 1,649 unique accounts, facilitating unauthorized access to critical systems and enabling fraudulent activities, including cargo theft and financial fraud. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/phishing-campaign-targets-freight-and-logistics-orgs-in-the-us-europe/?utm_source=openai)) This incident underscores a growing trend of targeted cyberattacks within the logistics sector, highlighting the urgent need for enhanced security measures and employee training to mitigate the risks associated with phishing and credential theft. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/phishing-campaign-targets-freight-and-logistics-orgs-in-the-us-europe/?utm_source=openai))
7 months ago
Kill Chain
Eurail 2026 Data Breach: What You Need to Know
In January 2026, Eurail B.V., the operator of the Interrail ticketing platform, experienced a security breach resulting in unauthorized access to customer data. The compromised information includes names, contact details, passport information, and, for some DiscoverEU participants, bank account references and health data. Upon discovery, Eurail secured its systems, initiated an investigation with external cybersecurity specialists, and began notifying affected customers and regulatory authorities. As of mid-January 2026, there is no evidence of data misuse or public disclosure. This incident underscores the critical importance of robust cybersecurity measures in the travel industry, especially given the sensitive nature of the data involved. Organizations must remain vigilant against evolving cyber threats and ensure compliance with data protection regulations to safeguard customer information.
7 months ago
Kill Chain
Critical Vulnerability in Avation Light Engine Pro Exposes Systems to Unauthorized Access
In February 2026, a critical vulnerability (CVE-2026-1341) was identified in Avation's Light Engine Pro devices, which are widely deployed in commercial facilities worldwide. The flaw involves the exposure of the device's configuration and control interface without any authentication or access control, potentially allowing unauthorized users to gain full control over the device. This vulnerability poses significant risks, including unauthorized access, data manipulation, and potential disruption of operations. ([itsecuritynews.info](https://www.itsecuritynews.info/avation-light-engine-pro/?utm_source=openai)) The absence of authentication mechanisms in critical infrastructure devices underscores the urgent need for robust security measures. Organizations must prioritize the implementation of authentication protocols and access controls to safeguard against such vulnerabilities, especially in devices integral to operational technology environments.
7 months ago
Kill Chain
Critical Unauthenticated Access Vulnerability in Synectix LAN 232 TRIO
In February 2026, a critical vulnerability (CVE-2026-1633) was identified in the Synectix LAN 232 TRIO 3-Port serial to Ethernet adapter. This flaw allows unauthenticated users to access the device's web management interface, enabling them to modify critical settings or perform a factory reset. The vulnerability has a CVSS score of 10.0, indicating maximum severity. Synectix is no longer in business, leaving the affected devices without official support or patches. ([securityonline.info](https://securityonline.info/unpatchable-critical-cisa-issues-cvss-10-0-alert-for-synectix-adapters/?utm_source=openai)) This incident underscores the risks associated with using unsupported legacy devices in critical infrastructure. Organizations must proactively identify and replace such equipment to mitigate potential security threats. ([securityonline.info](https://securityonline.info/unpatchable-critical-cisa-issues-cvss-10-0-alert-for-synectix-adapters/?utm_source=openai))
7 months ago
Kill Chain
Researchers Disclose Widespread Automotive and EV Vulnerabilities at Pwn2Own 2026
In January 2026, security researchers at the Pwn2Own Automotive World competition uncovered and exploited dozens of critical vulnerabilities in modern vehicle infotainment systems and EV (electric vehicle) chargers from multiple manufacturers. By chaining flaws across network interfaces and poorly secured APIs, attackers demonstrated the ability to remotely compromise vehicle systems, extract sensitive data, and gain unauthorized control over critical vehicle functions. While these attacks were conducted in a controlled, ethical hacking contest, they highlighted the substantial risks posed by connected automotive platforms, which often lack robust segmentation and encryption for internal and external communications. This incident underscores the rapidly escalating threat landscape facing the automotive industry as vehicles integrate more digital and cloud-connected components. The research-driven breach foreshadows what real-world adversaries may attempt, making it urgent for OEMs and suppliers to adopt zero trust, comprehensive monitoring, and proactive vulnerability management.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports