The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend.
The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit.
A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
The stdid-nyxprobe package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command to execute this code, serving no legitimate purpose beyond data exfiltration. The risk is limited but present due to the unauthorized data collection.
An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by inserting an image containing a malicious external URL into a comment. When a victim views the discussion thread, their browser automatically sends an HTTP/HTTPS request to the server controlled by the attacker, who can then collect information such as the source IP address, the User-Agent header, the date and time of access, and other metadata derived from the request, thereby compromising the user’s privacy.
A supply chain attack targeting Polymarket traders involved malicious code injected via a compromised third-party website monitoring tool, DebugBear. The malicious JavaScript hijacked logged-in user sessions to siphon funds by selling positions or transferring tokens to attacker-controlled addresses. Polymarket's international platform was affected, resulting in over $2 million in losses, while the US platform remained unaffected. Polymarket halted trading temporarily, removed the malicious script, and pledged to reimburse affected users. DebugBear confirmed the incident and advised users to remove its monitoring snippet.
Kairos is a newly documented Linux DDoS botnet written in Go that compromises machines via Telnet using default root credentials with empty passwords. It establishes hundreds to thousands of TCP connections to targeted services, maintaining them with minimal keepalive traffic to exhaust resources. The bot uses a simple three-command protocol and masquerades as a kernel worker thread. It supports multiple CPU architectures and uses a build-per-command-and-control distribution model.
CVE-2026-97229 is a critical code execution vulnerability in GitLab caused by insufficient validation in Ruby's Onigmo regular expression engine. It allows unauthenticated attackers to execute arbitrary code on the GitLab server via crafted CI/CD configurations. The vulnerability was exploited in an attempted attack against Alpine Linux's GitLab instance, which failed but prompted a full rebuild and password resets. The flaw is rooted in Ruby, not GitLab itself, requiring updates to Ruby versions 3.3.13, 3.4.12, 4.0.9 or later for full remediation. The US CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, urging rapid patching.
The Claude Code extension version 2.1.313 in the Cursor Marketplace was compromised with a malicious loader that installs an SSH backdoor. This backdoor adds an attacker-controlled SSH key to authorized_keys, attempts to enable local SSH services, and establishes a reverse SSH tunnel to a remote server. It collects system and user reconnaissance data and installs persistence mechanisms on macOS, Linux, and Windows. Communications with the command-and-control server are unencrypted, allowing persistent remote access.
A denial-of-service vulnerability in UAA's private_key_jwt client-authentication mechanism allows an attacker with write access to clients or a compromised endpoint to cause service unavailability. This occurs by triggering repeated parsing of large cached JSON Web Key Set (JWKS) objects, leading to excessive CPU usage and potential Java heap exhaustion resulting in OutOfMemoryError.
CVE-2026-59385 describes a vulnerability where a user with SpaceDeveloper privileges can modify the URL of a space-scoped broker without changing its credentials. This allows the user to indirectly extract existing broker credentials by redirecting them to a broker they control. The Cloud Foundry API does not allow direct reading of broker credentials, so this method bypasses that restriction. The vulnerability has a low severity score of 2.7 and does not impact integrity or availability.
Cloud Controller (CAPI) has multiple instances where sensitive data is leaked into audit logs. Specifically, credentials for custom buildpacks appear in audit events related to app manifest application, creation, and updates. Additionally, syslog drain URL credentials are exposed in user-provided service instance audit events, and service binding parameters are leaked in app manifest and service binding audit events. This exposure could lead to unauthorized access to sensitive credentials if audit logs are accessed by unauthorized parties.
Apache Fineract versions up to and including 1.15.0 are vulnerable to a time-based blind SQL injection via the Center read endpoint and datatable entry read endpoints. The vulnerability arises because user-supplied ordering parameters are concatenated directly into the SQL ORDER BY clause, bypassing existing regex validation. This flaw allows any authenticated user with read access to exploit the injection. Upgrading to version 1.16.1 addresses this issue.
CVE-2026-59386 is a vulnerability where a SpaceSupporter can improperly modify an application's start command and buildpack, actions normally restricted to SpaceDeveloper privileges. This privilege escalation allows unauthorized retrieval of service credentials by leveraging malicious start commands or custom buildpacks.
A misconfiguration in the Nginx routing for Cloud Controller allows unauthenticated access to certain staging callback endpoints under /internal/v3/. This permits attackers with a valid build or droplet GUID to submit forged staging callbacks, transition droplets to a STAGED state, and persist arbitrary metadata without proper authorization. The issue enables privilege escalation beyond intended role boundaries due to insufficient access controls on these endpoints.
A SQL Injection vulnerability exists in Apache Fineract through version 1.15.0. It affects the outStandingAmountPercentageCondition parameter of the /fineract-provider/api/v1/search/advance HTTP API endpoint due to improper neutralization of special elements in SQL commands. This allows attackers to inject malicious SQL code. The issue is fixed in version 1.16.1.
A vulnerability in GCC libstdc++ occurs when extracting data into a bitset from a wide-character stream, causing improper stack memory allocation related to character size and alignment. This flaw can lead to a stack-based buffer overflow, potentially resulting in a denial of service (DoS) if an attacker supplies crafted input. The vulnerability requires specific application behavior and is rated as medium severity with a CVSS score of 6.5. No patch or mitigation is currently available that meets Red Hat's criteria for ease of use and stability.