CVE-2026-44098 OS Command Injection in OCPP Agent via charge_box_id

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted...

CVE-2026-44098

CVE-2026-44098 describes an unauthenticated OS command injection in an OCPP backend/agent stack accessible via firewall-bypass. An attacker can control the backend and execute arbitrary commands as the limited user charx-oa, potentially interrupting charging. The connected documents provide the v...

EUVD-2026-51026

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss...

CVE-2026-44091

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss...

CVE-2026-44091

CVE-2026-44091 describes an unauthenticated remote attacker who can post a malicious ID to the MQTT Broker, causing the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss. The published CVSS metrics indicate a high severity: CVSS 4....

CVE-2026-67248

creationtimestamp| type| source ---|---|--- 2026-07-30 06:45:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/23bhethvirrjs 2026-08-04 14:26:13+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msb7rxlqal2c 2026-08-05 17:37:06+00:00| seen|...

CVE-2026-14223

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

CVE-2026-14305

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

CVE-2026-13145

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

EUVD-2026-51015

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...

CVE-2026-13395 Bookly < 27.8 - Unauthenticated SQL Injection via staff_id

The Online Scheduling and Appointment Booking System WordPress plugin before 27.8 does not sanitize or properly cast a user-supplied parameter from its unauthenticated front-end booking requests before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks an...

CVE-2026-13145

The WP Travel WordPress plugin versions before 11.8.1 contain a vulnerability that allows for Subscriber+ Booking PII Disclosure via an Insecure Direct Object Reference (IDOR) . The flaw arises because the plugin does not verify that a requested booking on the customer account dashboard belongs t...

EUVD-2026-51008

The WP Travel WordPress plugin before 11.8.1 does not verify that the booking requested on its customer account dashboard belongs to the current user, allowing any logged-in user to read another customer's booking details, including billing address information, by supplying an arbitrary booking...

CVE-2026-14223 Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR

The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

EUVD-2026-50984

The Easy Appointments WordPress plugin through 3.12.26 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier...

CVE-2026-16531

An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service...

CVE-2026-17898

creationtimestamp| type| source ---|---|--- 2026-07-30 05:19:25+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-08-03 10:54:41+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260803...

CVE-2026-17717

creationtimestamp| type| source ---|---|--- 2026-07-30 04:50:12+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-07-30 19:56:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv7v6gan42u 2026-08-03 09:40:20+00:00| seen|...

CVE-2026-17748

creationtimestamp| type| source ---|---|--- 2026-07-30 04:49:41+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-08-03 09:47:20+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260803...

CVE-2026-17691

creationtimestamp| type| source ---|---|--- 2026-07-30 04:47:22+00:00| seen| https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities20260730 2026-07-30 16:36:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruupk4vwc2i 2026-08-03 09:31:35+00:00| seen|...