2026

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns

A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.

The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-fo

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force a

The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Sto

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulator_pio_in Use __

PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer a

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into

Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system sh

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus f

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to exec

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local a

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryp

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid f

Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to di

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to p

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for fi

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, re

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to ex

An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configur

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user t

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not vali

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configura

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected fr

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Ele

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browse

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string

The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment vari

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL inject

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across ident

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cli

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foun

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network int

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running applicati

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in t

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU proce

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endp

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.fil