2026 CVE Vulnerabilities
51,113 CVEs published in 2026.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-44108 | CRITICAL | 9.8 | 0.5% | Jul 30, 2026 | Due to a flaw in the execution order of scripts during shutdown, the firewall is terminated prematurely during system sh... |
| CVE-2026-44107 | HIGH | 8.7 | 0.3% | Jul 30, 2026 | A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus f... |
| CVE-2026-44106 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to exec... |
| CVE-2026-44105 | MEDIUM | 6.6 | 0.1% | Jul 30, 2026 | The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local a... |
| CVE-2026-44104 | CRITICAL | 9.8 | 0.2% | Jul 30, 2026 | The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryp... |
| CVE-2026-44103 | MEDIUM | 6.9 | 0.2% | Jul 30, 2026 | An unauthenticated remote attacker can inject malicious firmware into the internal charging module because the JupiCore ... |
| CVE-2026-44102 | MEDIUM | 6.9 | 0.2% | Jul 30, 2026 | An unauthenticated remote attacker can trigger a firmware update download via the OCPP backend by supplying an invalid f... |
| CVE-2026-44101 | CRITICAL | 9.8 | 0.4% | Jul 30, 2026 | Due to missing authentication the CHARX OCPP Agent service allows an unauthenticated remote attacker to reconfigure the ... |
| CVE-2026-44100 | CRITICAL | 9.4 | 0.3% | Jul 30, 2026 | The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to di... |
| CVE-2026-44099 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary... |
| CVE-2026-44098 | HIGH | 8.8 | 1.4% | Jul 30, 2026 | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to p... |
| CVE-2026-44097 | HIGH | 7.1 | 0.2% | Jul 30, 2026 | A low-privileged remote attacker with "operator" access can upload arbitrary files via the REST endpoint intended for fi... |
| CVE-2026-44096 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, re... |
| CVE-2026-44095 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to ex... |
| CVE-2026-44094 | HIGH | 8.6 | 0.3% | Jul 30, 2026 | An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configur... |
| CVE-2026-44093 | HIGH | 8.5 | 0.2% | Jul 30, 2026 | A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user t... |
| CVE-2026-44092 | CRITICAL | 9.1 | 0.4% | Jul 30, 2026 | An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not vali... |
| CVE-2026-44091 | CRITICAL | 9.1 | 0.3% | Jul 30, 2026 | An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configura... |
| CVE-2026-44090 | CRITICAL | 9.8 | 0.4% | Jul 30, 2026 | Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected fr... |
| CVE-2026-13584 | HIGH | 7.1 | 0.1% | Jul 30, 2026 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Ele... |
| CVE-2026-64635 | MEDIUM | 5.3 | — | Jul 30, 2026 | Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an... |
| CVE-2026-59328 | MEDIUM | 4.2 | — | Jul 30, 2026 | Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browse... |
| CVE-2026-59327 | MEDIUM | 4.4 | — | Jul 30, 2026 | Spring Tools for Eclipse stores the Spring Boot DevTools remote secret (spring.devtools.remote.secret) as a plain string... |
| CVE-2026-59326 | LOW | 3.3 | — | Jul 30, 2026 | The Spring Boot language server logs the raw value of the https_proxy/HTTPS_PROXY/http_proxy/HTTP_PROXY environment vari... |
| CVE-2026-58066 | CRITICAL | 9.8 | 0.2% | Jul 30, 2026 | Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML ... |
Check if your code is affected by 2026 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now