CVE-2026-44098

CVE-2026-44098 describes an unauthenticated OS command injection in an OCPP backend/agent stack accessible via firewall-bypass. An attacker can control the backend and execute arbitrary commands as the limited user charx-oa, potentially interrupting charging. The connected documents provide the v...

CVE-2026-44098 OS Command Injection in OCPP Agent via charge_box_id

This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted...

anyone can call forceRemoveByActiveBalance()

Handle Tomio Vulnerability details Impact A user can call forceRemoveByActiveBalance and this function didn’t verify if the caller is equal to the protocol agent, that eventually clear the remaining balance. Proof of Concept --- The text was updated successfully, but these errors were encountered...

SherlockClaimManager: Incorrect amounts needed and paid for escalated claims

Handle GreyArt Vulnerability details Impact When escalating claims, the documentation states that the protocol agent is required to pay and stake a certain amount for the process. If the covered protocol is proven correct, then the amount specified by the claim will be paid out. They will also...