CVE-2025-68141

CVE-2025-68141 affects the EVerest EV charging software stack. Before version 2025.10.0, deserializing a DC_ChargeLoopRes message that includes Receipt and TaxCosts can access the vector tax_costs in Receipt out of bounds, in the function template void convert(const struct iso20_dc_DetailedTaxTy...

CVE-2025-68138 EVerest affected by memory exhaustion in libocpp

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the strdup calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potential...

EUVD-2025-206321

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the strdup calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potential...

CVE-2025-68138 EVerest affected by memory exhaustion in libocpp

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the strdup calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potential...

Everest-core code issues and vulnerabilities

Everest-core is a major component of the open-source electric vehicle charging software stack developed by EVerest. Versions of everest-core prior to 2025.10.0 contained code vulnerabilities. These vulnerabilities stemmed from out-of-bound vector access during the deserialization of DCChargeLoopR...

PT-2026-3857

EVerest is an EV charging software stack. Prior to version 2025.10.0, during the deserialization of a DC ChargeLoopRes message that includes Receipt as well as TaxCosts, the vector tax costs in the target Receipt structure is accessed out of bounds. This occurs in the method template void...

PT-2026-3851

EVerest is an EV charging software stack, and EVerest libocpp is a C++ implementation of the Open Charge Point Protocol. In libocpp prior to version 0.30.1, pointers returned by the strdup calls are never freed. At each connection attempt, the newly allocated memory area will be leaked, potential...

CVE-2023-49958

An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP Open Charge Point Protocol for electric vehicles. The server processes mishandle StartTransaction messages containing additional, arbitrary properties, or duplicate properties. The last occurrence of a duplicate property is...

CVE-2026-22539

As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6...

CVE-2026-22235

OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files...

CVE-2026-22235

OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files...

CVE-2026-22235 OPEXUS eComplaint IDOR

OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files...

CVE-2026-22235 OPEXUS eComplaint IDOR

OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files...

CVE-2026-22539

As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6...

CVE-2026-22539 INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)

As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6...

CVE-2026-22539 INFORMATION DISCLOSURE VIA CURL REQUESTS (OCPP)

As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6...

CVE-2026-22539

CVE-2026-22539 describes an information disclosure in OCPP v1.6 where service interactions occur without authentication, allowing an attacker with protocol knowledge to obtain charger information. Red Hat, NVD, CVE List and other sources corroborate that the issue affects Efacec QC charging posts...

Efacec QC 安全漏洞

Efacec QC is a series of electric vehicle charging posts from Efacec Portugal. A security vulnerability exists in the Efacec QC 60/90/120 that stems from a service interaction without authentication, which could lead to an attacker obtaining charger information via the OCPP v1.6 protocol...

PT-2026-2202

Name of the Vulnerable Software and Affected Versions OCPP versions 1.6 affected versions not specified Description The service interaction is performed without authentication, potentially allowing an attacker with protocol knowledge to obtain information about the charger. Recommendations At the...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2025-992778)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-992778 advisory. In the Linux kernel, the following vulnerability has been resolved: power: supply: gpio-charger: Fix set charge current limits Fix set charge current limits for...