Skip to content
OpenAdvisories

Archive

9 February 2026

Vulnerabilities first published on this day (UTC), newest first.

4 results · Clear filters · Feed

  • Critical 9.5
    CVE-2026-25895 Public exploit Scanner template EPSS 13%

    FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through ver…

  • Critical 9.3
    CVE-2026-25939 Public exploit Scanner template EPSS 24%

    FUXA Unauthenticated Remote Arbitrary Scheduler Write

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing conne…

  • Critical 9.5
    CVE-2026-25938 Public exploit

    FUXA Unauthenticated Remote Code Execution in Node-RED Integration

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is …

  • Critical 9.1
    CVE-2026-25057 Public exploit

    Zip Slip in MarkUs config upload allowing RCE

    MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, instructors are able to upload a zip file to create an assignment from an exported configuration (courses/<:course_id>/assignments/upload_config_files). The upl…