CVE-2026-77393 Inductive Automation Ignition Incorrect Default Permissions

In Ignition 8.1.53 and earlier, the Gateway "Create Project Roles" setting shipped blank, which permitted any authenticated user to create projects if they can execute gateway scripts. Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3...

EUVD-2026-71087

A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assertuserisadminifuserqueryparamisprovided of the file st2api/st2api/controllers/v1/actionexecutions.py of the component NoOp RBAC backend. This manipulation of the argument User causes improper privile...

CVE-2026-81302

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...

CVE-2026-81302

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...

EUVD-2026-70977

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...

CVE-2026-81302

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...

CVE-2026-81302

CVE-2026-81302 is currently a reserved candidate with no publicly disclosed technical details. The only record is a sighting linked to JVN (Japan Vulnerability Notes). Monitor for updates as the reserving organization publicizes the vulnerability.

BIT-JOOMLA-2026-73373 Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2

Joomla! Core - 20260810 - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

Multiple vulnerabilities in XING CPTrans-ME-X

Overview CPTrans-ME-X provided by XING Inc. contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2026-62928 Improper processing of the input through the administrative port may lead to OS command injection. Exposure of Sensitive System Information to an Unauthorized...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password vulnerability (CWE-1393), meaning anyone who knows the default credential can log in to the affected device. The vulnerability is rated CRITICAL with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 base score...

EUVD-2026-70918

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-69657

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

PT-2026-85411

🚨 CRITICAL: CVE-2026-69657 CVSS 9.8 XING CPTrans-ME-X uses default passwords allowing unauthorized remote access. Attackers can gain full control with no authentication required. Action: Change default credentials immediately. CVE Vulnerability PatchNow https://t.co/1Y4Tw4gKye...

PT-2026-85441

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...

CVE-2026-75430: Missing Authentication for Critical Function

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...

CVE-2026-69657: Use of Default Password

XING CPTrans-ME-X contains a Use of Default Password CWE-1393. Anyone with the knowledge of the credential may log in to the affected device...

CVE-2026-81302: Incorrect Default Permissions

PALLET CONTROL products contain an incorrect default permission vulnerability, which may allow a local attacker to execute arbitrary code with SYSTEM privileges on the affected product...

CVE-2026-75430

PowerJob Worker version 5.1.2 and likely earlier versions exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code...