Browse CVEs

HIGH 7.2 CVE-2026-15397 The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is du… No fix yet Fix from $1,9502026-07-30 HIGH 8.8 CVE-2026-22622 Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to … No fix yet Fix from $1,9502026-07-30 HIGH 8.3 CVE-2026-22621 Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administ… No fix yet Fix from $1,9502026-07-30 HIGH 8.6 CVE-2026-22620 Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker t… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.8 CVE-2026-18369 A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP… No fix yet Fix from $1,6002026-07-30 CRITICAL 9.1 CVE-2026-18363 A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the pas… No fix yet Fix from $2,3002026-07-30 MEDIUM 5.9 CVE-2026-18362 The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. No fix yet Fix from $1,6002026-07-30 HIGH 7.6 CVE-2026-18361 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. No fix yet Fix from $1,9502026-07-30 HIGH 7.6 CVE-2026-18360 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. No fix yet Fix from $1,9502026-07-30 MEDIUM 5.9 CVE-2026-16971 The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. No fix yet Fix from $1,6002026-07-30 HIGH 7.6 CVE-2026-16969 The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. No fix yet Fix from $1,9502026-07-30 HIGH 8.8 CVE-2026-18353 PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlp… No fix yet Fix from $1,9502026-07-30 CRITICAL 9.8 CVE-2026-7849 Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration whic… No fix yet Fix from $2,3002026-07-30 CRITICAL 9.8 CVE-2026-44108 Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a tempor… No fix yet Fix from $2,3002026-07-30 HIGH 7.5 CVE-2026-44107 A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by op… No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-44106 A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as roo… No fix yet Fix from $1,9502026-07-30 MEDIUM 6.6 CVE-2026-44105 The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the lo… No fix yet Fix from $1,6002026-07-30 CRITICAL 9.8 CVE-2026-44104 The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verificat… No fix yet Fix from $2,3002026-07-30 MEDIUM 5.3 CVE-2026-44103 An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware up… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-44102 An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause… No fix yet Fix from $1,6002026-07-30 CRITICAL 9.8 CVE-2026-44101 Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can … No fix yet Fix from $2,3002026-07-30 CRITICAL 9.4 CVE-2026-44100 The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UI… No fix yet Fix from $2,3002026-07-30 HIGH 7.8 CVE-2026-44099 A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting … No fix yet Fix from $1,9502026-07-30 HIGH 8.6 CVE-2026-44098 This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injectio… No fix yet Fix from $1,9502026-07-30 HIGH 7.1 CVE-2026-44097 A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in … No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-44096 A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compro… No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-44095 A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as r… No fix yet Fix from $1,9502026-07-30 HIGH 8.6 CVE-2026-44094 An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default crede… No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-44093 A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands … No fix yet Fix from $1,9502026-07-30 CRITICAL 9.1 CVE-2026-44092 An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches fro… No fix yet Fix from $2,3002026-07-30