Archive
July 2026
Vulnerabilities first published in this month (UTC), newest first.
9,908 results · Feed
-
High 8.8
Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could a…
-
High 8.3
Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could a…
-
High 8.6
Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an una…
-
Medium 4.2
DFIR-IRIS Insufficient Logout Implementation
The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for a long time.
-
Medium 5.9
DFIR-IRIS Missing Brute Force Protection in User Authentication
The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks.
-
Medium 5.9
DFIR-IRIS Missing Brute Force Protection in OTP Validation
The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks.
-
High 7.6
DFIR-IRIS Stored XSS in Datastore Upload
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function.
-
High 7.6
DFIR-IRIS Stored XSS in Custom Attributes
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function.
-
High 7.6
DFIR-IRIS Stored XSS in Assets
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function.
-
Unscored —
KVM: x86: wean fast IN from emulator_pio_in
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulator_pio_in Use __emulator_pio_in() directly for fast PIO instead of bouncing through emulator_pio_in() now that __emulator_pio_in() fills "val" when handling …
-
High 8.8
Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass
PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an a…
-
Critical 9.8
Command Injection in SCM (idledisconnect parameter)
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
-
Critical 9.8
Firewall bypass during shutdown
Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window in which internal services may become externally accessible, potentially allowing an unauthenticate…
-
High 7.5
Exposed Reboot via Modbus
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Servic…
-
Medium 6.6
Cleartext password in logs
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.
-
High 7.8
Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
Critical 9.8
ControllerAgent does not perform validation of firmware
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system c…
-
Medium 5.3
JupiCore does not perform validation of firmware
An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification check. Successful exploitation may compromise the integrity…
-
Medium 5.3
OCPP Firmware download is not properly locked
An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file to remain accessible for a short period before it is deleted due to improper locking during the clea…
-
Critical 9.8
OCPP reconfiguration vulnerability
Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and confidential data being disclosed to the attacker.
-
Critical 9.4
JupiCore charging point reconfiguration without auth
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.
-
High 7.8
Local Privilege Escalation via pppd password injection
A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
High 8.6
OS Command Injection in OCPP Agent via charge_box_id
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupte…
-
High 7.1
File Upload vulnerability
A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled files and potentially exhausting resources, which might lead to Deni…
-
High 7.8
udhcpc Privilege Escalation
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
-
High 7.8
Local Privilege Escalation via Network scripts
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
High 8.6
Fallback to second RAUC slot with default credentials
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Cha…
-
High 7.8
Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script
A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
-
Critical 9.1
Missing input validation / stripping of CRLF characters in SystemConfigManager
An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss.
-
Critical 9.1
Creation of a new configuration by posting a malicious ID to MQTT
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
-
Critical 9.8
Missing authentication for MQTT Broker
Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.
-
High 7.1
Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX-R model, MELSEC MX Controller MX-F model, Master/local module, CC-Link IE TSN interface board, Motion module,…
-
Critical 9.8
Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML…
-
Critical 9.9
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injec…
-
High 7.5CVE-2026-58043 Public exploit
A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Un…
-
Medium 4.1CVE-2026-56850 Public exploit
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cl…
-
Low 3.3CVE-2026-56847 Public exploit
A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside…
-
Medium 5.3
Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows a…
-
Medium 6.3CVE-2026-58040 Public exploit
An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across iden…
-
Medium 5.4
Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection
The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning or writing to that thread, allowing authenticated users with subscriber-level access and above who can access an…