CVE-2026-28230

SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId a sequential integer starting from 1 without verifying that the requesting charger matches...

CVE-2026-28230 In SteVe, any authenticated charger can terminate any other charger's active transaction (missing ownership verification on StopTransaction)

SteVe is an open-source EV charging station management system. In versions up to and including 3.11.0, when a charger sends a StopTransaction message, SteVe looks up the transaction solely by transactionId a sequential integer starting from 1 without verifying that the requesting charger matches...

CVE-2026-28230

SteVe (open-source EV charging station management) versions up to 3.11.0 are vulnerable to a StopTransaction impact where a charger can terminate another charger’s active session. Root cause: OcppServerRepositoryImpl.getTransaction() queries only by transactionId and does not verify chargeBoxId o...

DEBIAN-CVE-2024-35956

In the Linux kernel, the following vulnerability has been resolved: btrfs: qgroup: fix qgroup prealloc rsv leak in subvolume operations Create subvolume, create snapshot and delete subvolume all use btrfssubvolumereservemetadata to reserve metadata for the changes done to the parent subvolume's f...