EU Cyber Resilience Act · Regulation (EU) 2024/2847

Manufacturers of products with digital elements shall “identify and document vulnerabilities and components contained in products … including by drawing up a software bill of materials” and “address and remediate vulnerabilities without delay”. Annex I, Part II

Article 14 reporting duties have been in effect since 11 September 2026: actively exploited vulnerabilities must be notified within 24 hours.

412,564 published vulnerabilities
1,754 known to be actively exploitedCISA KEV catalogue

Latest CVE added to the CISA KEV catalogue · 20 October 2026

CVE-2026-110936 CVSS v3.1 6.7 · Medium

Siemens Software Center Uncontrolled Search Path Element Vulnerability

A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a…

As of 21 October 2026, from Lucerna's live CVE index.

Do these apply to your products?

Upload an SBOM. Lucerna matches every component against the full CVE index, tells you which vulnerabilities actually affect your build, and tracks what you must fix and report.

Smart products may live for years, but vulnerabilities never stop.

Vulnerability Management System

Forgot password?

New to Lucerna?

Start a free trial

enquiries@rufilla.com rufilla.com