176 matches found
CVE-2023-32198
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...
CVE-2023-32198 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...
EUVD-2023-60719
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...
CVE-2023-32198
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...
CVE-2023-32198
The rancher software suite, including rancher-agent , harvester , and harvester-fips packages, is affected by a vulnerability where Steve fails to validate remote server certificates by default during TLS connections. This Improper Certificate Validation (CWE-295) flaw allows for man-in-the-middl...
CVE-2023-32198 Steve doesn’t verify a server’s certificate and is susceptible to man-in-the-middle (MitM) attacks
A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presented by the remote server while performing a TLS connection. This could allow the execution of a man-in-the-middle MitM attack against services using Steve...
open-webui (>=0.5.17, <=0.6.5), open-webui-steve (0.6.5.45) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.14.2)
pymdown-extensions PYPI version 10.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.5.17, =0.6.5 - open-webui-steve 0.6.5.45 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-67422 Source...
open-webui (>=0.5.17, <=0.6.5), open-webui-steve (0.6.5.45) +1 more potentially affected by CVE-2026-67422 via pymdown-extensions (10.14.2)
pymdown-extensions PYPI version 10.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.5.17, =0.6.5 - open-webui-steve 0.6.5.45 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-67422 Source...
open-webui (>=0.5.17, <=0.6.5), open-webui-steve (0.6.5.45) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.14.2)
pymdown-extensions PYPI version 10.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.5.17, =0.6.5 - open-webui-steve 0.6.5.45 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-61632 Source...
open-webui (>=0.5.17, <=0.6.5), open-webui-steve (0.6.5.45) +1 more potentially affected by CVE-2026-61632 via pymdown-extensions (10.14.2)
pymdown-extensions PYPI version 10.14.2 is affected by a known vulnerability. The following packages have a transitive dependency on pymdown-extensions and may be impacted: - open-webui =0.5.17, =0.6.5 - open-webui-steve 0.6.5.45 - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-61632 Source...
CVE-2026-28230
SteVe (open-source EV charging station management) versions up to 3.11.0 are vulnerable to a StopTransaction impact where a charger can terminate another charger’s active session. Root cause: OcppServerRepositoryImpl.getTransaction() queries only by transactionId and does not verify chargeBoxId o...
CVE-2026-28230 In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)
SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId a sequential integer starting from 1 without verifying that the requesting charger matches...
EUVD-2026-8917
SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId a sequential integer starting from 1 without verifying that the requesting charger matches...
CVE-2026-28230 In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)
SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId a sequential integer starting from 1 without verifying that the requesting charger matches...
CVE-2026-28230
SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId a sequential integer starting from 1 without verifying that the requesting charger matches...
CVE-2026-28230 In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)
SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId a sequential integer starting from 1 without verifying that the requesting charger matches...
PT-2026-22220
Name of the Vulnerable Software and Affected Versions SteVe versions up to and including 3.11.0 Description SteVe is an open-source EV charging station management system susceptible to a transaction hijacking issue. An attacker controlling a registered charger, or even without registration...
SteVe Access Control Vulnerability
SteVe is an open platform developed by the SteVe Community. It is used for implementing, testing, and evaluating novel ideas related to electric vehicles, such as authentication protocols, charging point reservation mechanisms, and business models for electric vehicles. Versions of SteVe prior to...
CVE-2026-28230: Improper Access Control
SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId a sequential integer starting from 1 without verifying that the requesting charger matches...
CVE-2026-24526
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Steve Truman Email Inquiry & Cart Options for WooCommerce woocommerce-email-inquiry-cart-options allows DOM-Based XSS.This issue affects Email Inquiry & Cart Options for WooCommerce: from n/a throu...