Browse CVEs

MEDIUM 6.6 CVE-2026-44105 The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the lo… No fix yet Fix from $1,6002026-07-30 CRITICAL 9.8 CVE-2026-44104 The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verificat… No fix yet Fix from $2,3002026-07-30 MEDIUM 5.3 CVE-2026-44103 An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware up… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-44102 An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause… No fix yet Fix from $1,6002026-07-30 CRITICAL 9.8 CVE-2026-44101 Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can … No fix yet Fix from $2,3002026-07-30 CRITICAL 9.4 CVE-2026-44100 The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UI… No fix yet Fix from $2,3002026-07-30 HIGH 7.8 CVE-2026-44099 A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting … No fix yet Fix from $1,9502026-07-30 HIGH 8.6 CVE-2026-44098 This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injectio… No fix yet Fix from $1,9502026-07-30 HIGH 7.1 CVE-2026-44097 A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in … No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-44096 A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compro… No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-44095 A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as r… No fix yet Fix from $1,9502026-07-30 HIGH 8.6 CVE-2026-44094 An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default crede… No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-44093 A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands … No fix yet Fix from $1,9502026-07-30 CRITICAL 9.1 CVE-2026-44092 An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches fro… No fix yet Fix from $2,3002026-07-30 CRITICAL 9.1 CVE-2026-44091 An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system conf… Mitigation only Fix from $2,3002026-07-30 CRITICAL 9.8 CVE-2026-44090 Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firew… No fix yet Fix from $2,3002026-07-30 HIGH 7.1 CVE-2026-13584 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.3 CVE-2026-64635 Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to … No fix yet Fix from $1,6002026-07-30 CRITICAL 9.8 CVE-2026-58066 Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind t… Patch available Fix from $2,3002026-07-30 CRITICAL 9.9 CVE-2026-58046 Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data f… No fix yet Fix from $2,3002026-07-30 HIGH 7.5 CVE-2026-58043 A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an atta… No fix yet Fix from $1,9502026-07-30 MEDIUM 6.3 CVE-2026-58040 An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix … No fix yet Fix from $1,6002026-07-30 HIGH 8.3 CVE-2026-47882 When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tool… No fix yet Fix from $1,9502026-07-30 HIGH 8.0 CVE-2026-47873 The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than… No fix yet Fix from $1,9502026-07-30 HIGH 8.0 CVE-2026-47858 Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-bas… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.3 CVE-2026-16531 An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.5 CVE-2026-16530 A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` functio… No fix yet Fix from $1,6002026-07-30 HIGH 7.5 CVE-2026-16529 A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. Th… No fix yet Fix from $1,9502026-07-30 HIGH 7.3 CVE-2026-16527 An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacke… No fix yet Fix from $1,9502026-07-30 HIGH 8.8 CVE-2026-16526 A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate… No fix yet Fix from $1,9502026-07-30