Total
403375 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-22562 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| A malicious actor with access to the UniFi Play network could exploit a Path Traversal vulnerability found in the device firmware to write files on the system that could be used for a remote code execution (RCE). Affected Products: UniFi Play PowerAmp (Version 1.0.35 and earlier) UniFi Play Audio Port (Version 1.0.24 and earlier) Mitigation: Update UniFi Play PowerAmp to Version 1.0.38 or later Update UniFi Play Audio Port to Version 1.1.9 or later | |||||
| CVE-2026-22560 | 1 Rocket.chat | 1 Rocket.chat | 2026-06-17 | N/A | 5.3 MEDIUM |
| An open redirect vulnerability in Rocket.Chat versions prior to 8.4.0 allows users to be redirected to arbitrary URLs by manipulating parameters within a SAML endpoint. | |||||
| CVE-2026-22559 | 2026-06-17 | N/A | 8.8 HIGH | ||
| An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into clicking a malicious link. Affected Products: UniFi Network Server (Version 10.1.85 and earlier) Mitigation: Update UniFi Network Server to Version 10.1.89 or later. | |||||
| CVE-2026-22558 | 2026-06-17 | N/A | 7.7 HIGH | ||
| An Authenticated NoSQL Injection vulnerability found in UniFi Network Application could allow a malicious actor with authenticated access to the network to escalate privileges. | |||||
| CVE-2026-22557 | 2026-06-17 | N/A | 10.0 CRITICAL | ||
| A malicious actor with access to the network could exploit a Path Traversal vulnerability found in the UniFi Network Application to access files on the underlying system that could be manipulated to access an underlying account. | |||||
| CVE-2026-22553 | 1 Insat | 1 Masterscada | 2026-06-17 | N/A | 9.8 CRITICAL |
| All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution. | |||||
| CVE-2026-22552 | 1 Epower | 1 Epower.ie | 2026-06-17 | N/A | 9.4 CRITICAL |
| WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this can lead to privilege escalation, unauthorized control of charging infrastructure, and corruption of charging network data reported to the backend. | |||||
| CVE-2026-22550 | 1 Elecom | 4 Wrc-x1500gs-b, Wrc-x1500gs-b Firmware, Wrc-x1500gsa-b and 1 more | 2026-06-17 | N/A | 8.8 HIGH |
| OS command injection vulnerability exists in ELECOM wireless LAN products. A crafted request from a logged-in user may lead to an arbitrary OS command execution. | |||||
| CVE-2026-22549 | 3 F5, Kubernetes, Redhat | 3 Big-ip Container Ingress Services, Kubernetes, Openshift | 2026-06-17 | N/A | 4.9 MEDIUM |
| A vulnerability exists in F5 BIG-IP Container Ingress Services that may allow excessive permissions to read cluster secrets. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-22548 | 1 F5 | 2 Big-ip Advanced Web Application Firewall, Big-ip Application Security Manager | 2026-06-17 | N/A | 5.9 MEDIUM |
| When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests along with conditions beyond the attacker's control can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-22545 | 1 Mattermost | 1 Mattermost Server | 2026-06-17 | N/A | 3.1 LOW |
| Mattermost versions 10.11.x <= 10.11.10 fail to validate user's authentication method when processing account auth type switch which allows an authenticated attacker to change account password without confirmation via falsely claiming a different auth provider.. Mattermost Advisory ID: MMSA-2026-00583 | |||||
| CVE-2026-22544 | 2026-06-17 | N/A | N/A | ||
| An attacker with a network connection could detect credentials in clear text. | |||||
| CVE-2026-22543 | 2026-06-17 | N/A | N/A | ||
| The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials | |||||
| CVE-2026-22542 | 2026-06-17 | N/A | N/A | ||
| An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service. | |||||
| CVE-2026-22541 | 2026-06-17 | N/A | N/A | ||
| The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly. | |||||
| CVE-2026-22540 | 2026-06-17 | N/A | N/A | ||
| The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be operating correctly for the charger to also function correctly. | |||||
| CVE-2026-22539 | 2026-06-17 | N/A | N/A | ||
| As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6. | |||||
| CVE-2026-22537 | 2026-06-17 | N/A | N/A | ||
| The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker. | |||||
| CVE-2026-22536 | 2026-06-17 | N/A | N/A | ||
| The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions | |||||
| CVE-2026-22535 | 2026-06-17 | N/A | N/A | ||
| An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications | |||||