CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-94293

The aas-edge-client REST API is vulnerable to a missing authentication flaw for critical functions. An unauthenticated remote attacker can perform PATCH requests to modify Asset Administration Shell submodel data and use GET endpoints to read all exposed data. No specific exploit details or remed...

CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

EUVD-2026-90890

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924 are vulnerable to an authorization header leakage due to a shared request handler that attaches the Authorization header to outgoing requests without verifying the destination origin. An attacker can trick a user into c...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-101322: Insertion of Sensitive Information Into Sent Data

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

PT-2026-103910

In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

CVE-2026-57898

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

CVE-2026-57898: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using the MongoDB backend are vulnerable to an unauthenticated arbitrary file write through the AAS thumbnail API. The AAS thumbnail upload path accepted a client-controlled fileName request parameter...

PT-2026-57990

Name of the Vulnerable Software and Affected Versions Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 through 2.0.0-milestone-12 Description Deployments using the MongoDB backend are subject to an unauthenticated arbitrary file write via the AAS thumbnail API. The issue occurs because t...

a360-python-libraries (>=0.3.6, <=1.1.1), aa-ui (1.0.505) +606 more potentially affected by CVE-2026-54282 via starlette (0.37.2)

starlette PYPI version 0.37.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - a360-python-libraries =0.3.6, =0.3.0, =0.2.1, =0.1.0, =0.1.0, =0.8.0, =0.14.14a1, =0.0.4, =0.1.2, =0.1.0, =0.1.1 and more Source cves:...

a360-python-libraries (>=0.3.6, <=1.1.1), aa-ui (1.0.505) +606 more potentially affected by CVE-2026-48817 via starlette (0.37.2)

starlette PYPI version 0.37.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - a360-python-libraries =0.3.6, =0.3.0, =0.2.1, =0.1.0, =0.1.0, =0.8.0, =0.14.14a1, =0.0.4, =0.1.2, =0.1.0, =0.1.1 and more Source cves:...

a360-python-libraries (>=0.3.6, <=1.1.1), aa-ui (1.0.505) +606 more potentially affected by CVE-2026-48817 via starlette (0.37.2)

starlette PYPI version 0.37.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - a360-python-libraries =0.3.6, =0.3.0, =0.2.1, =0.1.0, =0.1.0, =0.8.0, =0.14.14a1, =0.0.4, =0.1.2, =0.1.0, =0.1.1 and more Source cves:...

a360-python-libraries (>=0.3.6, <=1.1.1), aa-ui (1.0.505) +606 more potentially affected by CVE-2026-48710 via starlette (0.37.2)

starlette PYPI version 0.37.2 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - a360-python-libraries =0.3.6, =0.3.0, =0.2.1, =0.1.0, =0.1.0, =0.8.0, =0.14.14a1, =0.0.4, =0.1.2, =0.1.0, =0.1.1 and more Source cves:...

EUVD-2026-34099

An OS command injection vulnerability in the app.py component of openlabs docker-wkhtmltopdf-aas up to commit 9f50579 allows attackers to execute arbitrary commands via a crafted POST request...