2026

A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus f

A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to exec

The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local a

The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryp

An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore

An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid f

Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the

The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to di

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to p

A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for fi

A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, re

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to ex

An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configur

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user t

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not vali

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configura

Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected fr

Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Ele

Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an

Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browse

Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string

The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment vari

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL inject

A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.

An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across ident

A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) cli

A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside

When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foun

The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network int

Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running applicati

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a

A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in t

A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU proce

An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endp

A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution

A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.fil

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce chec

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a fr

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX han

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated

The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the oper

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking

The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative

The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submiss

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a

The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, al

The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks befor