Csaf
by Cisagov
Source repositories
CVEs (180)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-67652 | Med | 0.40 | 6.1 | 0.00 | Jan 22, 2026 | An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likelihood of this type… | ||
| CVE-2025-25051 | Med | 0.40 | 6.1 | 0.00 | Jan 22, 2026 | An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks. | ||
| CVE-2026-32645 | Med | 0.39 | 6.0 | 0.00 | Oct 9, 2026 | Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts. | ||
| CVE-2026-40425 | Med | 0.37 | 5.7 | 0.01 | May 29, 2026 | The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password. | ||
| CVE-2026-33570 | Med | 0.37 | 5.7 | 0.00 | May 12, 2026 | PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions. | ||
| CVE-2026-26049 | Med | 0.37 | 5.7 | 0.00 | Feb 20, 2026 | The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, … | ||
| CVE-2026-61378 | Med | 0.36 | 5.5 | 0.00 | Jul 16, 2026 | A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash. | ||
| CVE-2026-6807 | Med | 0.36 | 5.5 | 0.00 | Apr 28, 2026 | A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process. | ||
| CVE-2026-107334 | Med | 0.35 | 5.4 | 0.00 | Oct 8, 2026 | Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx… | ||
| CVE-2026-90449 | Med | 0.35 | 6.5 | 0.00 | Sep 11, 2026 | When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative… | ||
| CVE-2026-90448 | Med | 0.35 | 6.5 | 0.00 | Sep 11, 2026 | A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an… | ||
| CVE-2026-90447 | Med | 0.35 | 6.5 | 0.00 | Sep 11, 2026 | A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service… | ||
| CVE-2026-90445 | Med | 0.35 | 6.5 | 0.00 | Sep 11, 2026 | An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries… | ||
| CVE-2026-44611 | Med | 0.35 | 5.4 | 0.00 | May 29, 2026 | Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks. | ||
| CVE-2026-42951 | Med | 0.35 | 5.4 | 0.00 | May 29, 2026 | An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes. | ||
| CVE-2026-97858 | Med | 0.34 | 5.3 | — | Oct 16, 2026 | An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID. | ||
| CVE-2026-105664 | Med | 0.34 | 5.3 | — | Oct 16, 2026 | The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without… | ||
| CVE-2026-85479 | Med | 0.34 | 5.3 | 0.00 | Oct 9, 2026 | The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it. | ||
| CVE-2026-42932 | Med | 0.34 | 5.3 | 0.00 | Jun 12, 2026 | Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can… | ||
| CVE-2026-4293 | Med | 0.34 | 5.3 | 0.00 | May 20, 2026 | The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows the attacker to control the browser. |
- risk 0.40cvss 6.1epss 0.00
An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to systems and services. The absence of robust encryption or secure handling mechanisms increases the likelihood of this type…
- risk 0.40cvss 6.1epss 0.00
An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks.
- risk 0.39cvss 6.0epss 0.00
Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts.
- risk 0.37cvss 5.7epss 0.01
The administrator account for the Danelec MacGregor Voyage Data Recorder web interface can directly edit sensitive files related to authentication, potentially changing the root password.
- risk 0.37cvss 5.7epss 0.00
PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions.
- risk 0.37cvss 5.7epss 0.00
The web management interface of the device renders the passwords in a plaintext input field. The current password is directly visible to anyone with access to the UI, potentially exposing administrator credentials to unauthorized observation via shoulder surfing, …
- risk 0.36cvss 5.5epss 0.00
A divide-by-zero vulnerability in the Productivity Suite allows a local attacker to cause a division by zero leading to a system crash.
- risk 0.36cvss 5.5epss 0.00
A vulnerability in GRASSMARLIN v3.2.1 allows crafted session data to trigger improper handling of XML input, which may result in unintended exposure of sensitive information. The flaw stems from insufficient hardening of the XML parsing process.
- risk 0.35cvss 5.4epss 0.00
Malcolm's nginx Lua role-based access control (RBAC) layer decides whether an authenticated user may reach a role-restricted path (e.g. /htadmin, /auth, /admin_login, /arkime/api/esadmin, NetBox, upload endpoints) by pattern-matching the raw, percent-encoded request URI. Nginx…
- risk 0.35cvss 6.5epss 0.00
When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative…
- risk 0.35cvss 6.5epss 0.00
A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which request methods are allowed. One such route accepts a request that creates or overwrites a stored record, including an…
- risk 0.35cvss 6.5epss 0.00
A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-supplied request header, rather than on any property the client cannot control. An authenticated user in possession of a shared service…
- risk 0.35cvss 6.5epss 0.00
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries…
- risk 0.35cvss 5.4epss 0.00
Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks.
- risk 0.35cvss 5.4epss 0.00
An authenticated user can download a backup of the Danelec MacGregor Voyage Data Recorder device which includes account data and password hashes.
- risk 0.34cvss 5.3epss —
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether the device is currently bound to a different account, allowing an attacker to obtain the device's full serial ID.
- risk 0.34cvss 5.3epss —
The endpoint exposes an observable response discrepancy when processing ID values. A request submitted with a nonexistent ID returns a distinct error response code from one submitted with a valid, registered ID, allowing an attacker holding a valid access token - but without…
- risk 0.34cvss 5.3epss 0.00
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.
- risk 0.34cvss 5.3epss 0.00
Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable identifier space. Because the platform also exposes an endpoint that reveals the current identifier high-water mark, the active fleet can…
- risk 0.34cvss 5.3epss 0.00
The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the victim's browser, which allows the attacker to control the browser.
Page 8 of 9