CVE-2026-58265

The BACnet Stack , an open-source C library for embedded systems, contains a heap out-of-bounds read vulnerability in versions prior to 1.4.5, 1.5.1, and 1.6.0. The flaw exists in the bvlc_sc_decode_proprietary_option() function within the BACnet/SC header-option decoder. Specifically, the functi...

CVE-2026-52788

The BACnet Stack C library for embedded systems contains three bugs in the bsc_node_parse_urls() function within src/bacnet/datalink/bsc/bsc-node.c. These bugs occur during the parsing of space-separated WebSocket URIs from a BACnet/SC Address Resolution ACK message. Specifically, two bugs result...

CVE-2025-41765 Unchecked role in wwwupload.cgi

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and...

CVE-2025-41765

Due to insufficient authorization enforcement, an unauthorized remote attacker can exploit the wwwupload.cgi endpoint to upload and apply arbitrary data. This includes, but is not limited to, contact images, HTTPS certificates, system backups for restoration, server peer configurations, and...

PT-2026-24035

Name of the Vulnerable Software and Affected Versions Versions prior to 2025-41765 Description Insufficient authorization enforcement allows a remote attacker to upload and apply arbitrary data through the wwwupload.cgi endpoint. This includes contact images, HTTPS certificates, system backups,...