CLSA-2026-1792161542 TuxCare security update for @remix-run/server-runtime (3 CVEs)

TuxCare rebuilt @remix-run/server-runtime to address 3 CVEs. Fixed in 1.19.3-tuxcare.4...

CLSA-2026-1792161540 TuxCare security update for @remix-run/server-runtime (1 CVE)

TuxCare rebuilt @remix-run/server-runtime to address 1 CVE. Fixed in 1.19.3-tuxcare.1...

CLSA-2026-1792161539 TuxCare security update for @remix-run/server-runtime (4 CVEs)

TuxCare rebuilt @remix-run/server-runtime to address 4 CVEs. Fixed in 2.17.0-tuxcare.1...

CLSA-2026-1792160940 TuxCare security update for @remix-run/server-runtime (1 CVE)

TuxCare rebuilt @remix-run/server-runtime to address 1 CVE. Fixed in 2.17.0-tuxcare.2...

PT-2026-124120

TuxCare rebuilt @remix-run/server-runtime to address 4 CVEs. Fixed in 2.17.0-tuxcare.1...

PT-2026-123675

TuxCare rebuilt @remix-run/server-runtime to address 1 CVE. Fixed in 2.17.0-tuxcare.2...

PT-2026-124121

TuxCare rebuilt @remix-run/server-runtime to address 1 CVE. Fixed in 1.19.3-tuxcare.1...

PT-2026-124122

TuxCare rebuilt @remix-run/server-runtime to address 3 CVEs. Fixed in 1.19.3-tuxcare.4...

CVE-2026-100552 OpenClaw before 2026.8.1 Policy Bypass via Native Tools

OpenClaw npm package 'openclaw' before 2026.8.1 does not correctly enforce per-chat tool policies for Codex app-server runtime tools. A conversation-level tools.allow rule filtered OpenClaw tools but did not restrict the shell, process, file, and patch tools owned by the Codex runtime. When a...

CVE-2026-65985

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

CVE-2026-67440

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICEBROWSE, DEVICENODEATTRIBUTE, HOSTINTERFACES, and DEVICETAGSREQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata...

CVE-2026-47719

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the DEVICEWEBAPIREQUEST and DEVICEPROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote...

CVE-2026-67442: Improper Access Control

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a...

CVE-2026-67440: Missing Authorization

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICEBROWSE, DEVICENODEATTRIBUTE, HOSTINTERFACES, and DEVICETAGSREQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata...

CVE-2026-47719: Server-Side Request Forgery (SSRF)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the DEVICEWEBAPIREQUEST and DEVICEPROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote...

CVE-2026-72586

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

PT-2026-69470

Name of the Vulnerable Software and Affected Versions frangoteam/FUXA versions prior to 1.3.4 Description A missing authentication flaw allows an unauthenticated remote attacker to query all historical sensor data. This occurs because the DAQ QUERY Socket.IO event handler in server/runtime/index....

CVE-2026-72586: Missing Authentication for Critical Function

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, et...

IBM Decision Server Runtime Panel- Detect

IBM Decision Server Runtime was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Decision Server Runtime was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IBM Decision Server Runtime Panel-...

CVE-2026-42342

A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denia...