Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (13 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-44107 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 7.5 High
A reboot of the charging controller can be triggered via Modbus TCP without authentication. Therefore, when the Modbus functionality is enabled by opening the port that CharxModbusServer is listening, an unauthenticated attacker can perform a Denial-of-Service attack.
CVE-2026-44099 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 7.8 High
A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
CVE-2026-7849 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.8 Critical
Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root.
CVE-2026-44104 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.8 Critical
The firmware update process for the basemodule of the charging controller only validates the CRC32 checksum without cryptographic signature verification. This allows an unauthenticated remote attacker to install a modified firmware, resulting in full system compromise.
CVE-2026-44094 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 8.6 High
An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted.
CVE-2026-44098 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 8.6 High
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.
CVE-2026-44090 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.8 Critical
Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firewall. This may lead to the device being fully compromised.
CVE-2026-44095 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 7.8 High
A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.
CVE-2026-44100 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.4 Critical
The CHARX JupiCore service allows an unauthenticated remote attacker to reconfigure charging points. This can lead to disclosure of charging point UIDs, Denial-of-Service and files tampering.
CVE-2026-44105 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 6.6 Medium
The credentials for the local user "user-app" may be exposed in log files, potentially enabling a low-privileged local attacker with access to the logs to authenticate via SSH as the limited user "user-app". Charging could be interrupted.
CVE-2026-44091 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 9.1 Critical
An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss.
CVE-2026-44096 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 7.8 High
A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise.
CVE-2026-44106 2 Phoenix Contact, Phoenixcontact 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more 2026-07-30 7.8 High
A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise.