CVE-2026-27828

EVerest is an EV charging software stack. Prior to version 2026.02.0, ISO15118_chargerImpl::handle_session_setup uses v2g_ctx after it has been freed when ISO15118 initialization fails (e.g., no IPv6 link-local address). The EVSE process can be crashed remotely by an attacker with MQTT access who issues a session_setup command while v2g_ctx has been released. Version 2026.02.0 contains a patch.

• CWE-416

• https://github.com/EVerest/EVerest/security/advisories/GHSA-5g3v-qc79-qqwrMitigation, Vendor Advisory

Published

Mar 26, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-27821GPAC is an open-source multimedia framework. In versions up …7.8
• CVE-2026-27822RustFS is a distributed object storage system built in Rust.…5.4
• CVE-2026-27823A vulnerability has been identified in EGroupware that may l…8.7
• CVE-2026-27824calibre is a cross-platform e-book manager for viewing, conv…5.3
• CVE-2026-27825MCP Atlassian is a Model Context Protocol (MCP) server for A…8
• CVE-2026-27826MCP Atlassian is a Model Context Protocol (MCP) server for A…8.2
• CVE-2026-27829Astro is a web framework. In versions 9.0.0 through 9.5.3, a…7.2
• CVE-2026-2783Information disclosure due to JIT miscompilation in the Java…7.5
• CVE-2026-27830c3p0, a JDBC Connection pooling library, is vulnerable to at…8
• CVE-2026-27831rldns is an open source DNS server. Version 1.3 has a heap-b…7.5
• CVE-2026-27832Group-Office is an enterprise customer relationship manageme…8.8
• CVE-2026-27833Piwigo is an open source photo gallery application for the w…7.5