Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
50589
Total
4065
Critical
14978
High
14744
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-18369 | MEDIUM | 5.8 | A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects … | Jul 30, 2026 |
| CVE-2026-18363 | UNKNOWN | — | A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, … | Jul 30, 2026 |
| CVE-2026-18362 | MEDIUM | 5.9 | The IRIS web application in version 2.4.26 and possibly others does not protect its user authentication against brute-force attacks. | Jul 30, 2026 |
| CVE-2026-18361 | HIGH | 7.6 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. | Jul 30, 2026 |
| CVE-2026-18360 | HIGH | 7.6 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. | Jul 30, 2026 |
| CVE-2026-16971 | MEDIUM | 5.9 | The IRIS web application in version 2.4.26 and possibly others does not protect its MFA validation against brute-force attacks. | Jul 30, 2026 |
| CVE-2026-16970 | MEDIUM | 4.2 | The IRIS web application in version 2.4.26 and possibly others contains a logout functionality which is ineffective. Stolen session cookies can therefore be misused for … | Jul 30, 2026 |
| CVE-2026-16969 | HIGH | 7.6 | The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. | Jul 30, 2026 |
| CVE-2022-4994 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulator_pio_in Use __emulator_pio_in() directly for fast PIO instead of … | Jul 30, 2026 |
| CVE-2026-18353 | UNKNOWN | — | PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery … | Jul 30, 2026 |
| CVE-2026-7849 | CRITICAL | 9.8 | Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed … | Jul 30, 2026 |
| CVE-2026-44108 | CRITICAL | 9.8 | Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system shutdown. This creates a temporary window … | Jul 30, 2026 |
| CVE-2026-44107 | HIGH | 7.5 | A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port … | Jul 30, 2026 |
| CVE-2026-44106 | HIGH | 7.8 | A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise. | Jul 30, 2026 |
| CVE-2026-44105 | MEDIUM | 6.6 | The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to … | Jul 30, 2026 |
| CVE-2026-44104 | CRITICAL | 9.8 | The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote … | Jul 30, 2026 |
| CVE-2026-44103 | MEDIUM | 5.3 | An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore service transmits firmware updates without performing integrity or verification … | Jul 30, 2026 |
| CVE-2026-44102 | MEDIUM | 5.3 | An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid firmware file. This will cause the file … | Jul 30, 2026 |
| CVE-2026-44101 | CRITICAL | 9.8 | Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the backend connection. This can lead to Denial-of-Service and … | Jul 30, 2026 |
| CVE-2026-44100 | CRITICAL | 9.4 | The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files … | Jul 30, 2026 |
| CVE-2026-44099 | HIGH | 7.8 | A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise. | Jul 30, 2026 |
| CVE-2026-44098 | HIGH | 8.6 | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution … | Jul 30, 2026 |
| CVE-2026-44097 | HIGH | 7.1 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for firmware updates, resulting in persistent storage of attacker-controlled … | Jul 30, 2026 |
| CVE-2026-44096 | HIGH | 7.8 | A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise. | Jul 30, 2026 |
| CVE-2026-44095 | HIGH | 7.8 | A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full … | Jul 30, 2026 |