CVE-2026-43947

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-43947

FUXA vulnerability CVE-2026-43947 affects version 1.3.0 where, when secureEnabled is true, an unauthenticated user can trigger Remote Code Execution via POST /api/runscript with test: true if they know a valid script ID/name and at least one server-side script exists. The attack bypasses authoriz...

CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-43947 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization against the stored script's permission by ID, but when test: tr...

CVE-2026-8985 Unauthenticated Command Injection

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

CVE-2026-8985 Unauthenticated Command Injection

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

CVE-2026-8985

CVE-2026-8985 affects Autel Maxi Charger Single firmware up to version 1.03.51. The vulnerability is an OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can craft input in the URL parameter to execute arbitrary operating-system commands. The NVD ent...

CVE-2026-8985

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

CVE-2026-8984 Unauthenticated RCE

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges...

CVE-2026-8984

Autel Maxi Charger Single firmware up to version V1.03.51 is affected. The vulnerability allows unauthenticated remote code execution via a service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files ...

CVE-2026-8984 Unauthenticated RCE

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges...

CVE-2026-8984

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-47690 MeltanoHub vulnerable to command injection in the `test_dispatcher` GitHub Actions workflow

MeltanoHub is the source code for hub.meltano.com, the central place for Meltano plugins. Versions of the repo prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173 were vulnerable to exfiltration of GITHUBTOKEN with write permissions to the repository. The vulnerable workflow used...

CVE-2026-47690

MeltanoHub (hub.meltano.com) had a vulnerability in versions prior to commit 923820de8f64d753951fbbd54f7282a3d5f75173, where a pull_request_target workflow could exfiltrate the repository GITHUB_TOKEN with write permissions. The issue was fixed by the commit 923820de8f64d753951fbbd54f7282a3d5f751...

CVE-2026-46403 Klever-Go KVM read-only execution can commit contract delete and upgrade side effects

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...

CVE-2026-46403

Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.17, KVM exposes ExecuteReadOnlyWithTypedArguments as a read-only execution mechanism. The hook saves the previous read-only state, sets runtime.SetReadOnlytrue, executes the destination context, and then restores t...

CVE-2026-46403

Summary (verified): Klever-Go KVM read-only execution can leak state changes via contract delete/upgrade side effects when invoked through ExecuteReadOnlyWithTypedArguments. The root cause is applying read-only as runtime state while not enforcing it in state-changing host-core paths, allowing a ...