CVE Vulnerability Catalog

A security vulnerability has been detected in Besen BS20 EV Charging Station up to version 20260426 in the BLE/WiFi component. Manipulation leads to authentication bypass via capture-replay attack. The attack requires local network access and is highly complex.

A security flaw has been discovered in Besen BS20 EV Charging Station up to version 20260426 in the firmware version check functionality. Manipulation results in improper restriction of rendered UI layers. The attack is remote but requires high complexity.

In Besen BS20 EV Charging Station up to version 20260426, an unknown function of the BLE/UDP component leads to insufficiently protected credentials. The attack requires local network access.

In Besen BS20 EV Charging Station up to version 20260426, the Bluetooth Low Energy Handler component has a vulnerability that leads to weak password requirements. The attack requires local network access and is considered difficult to exploit.

A cross-site scripting vulnerability was found in SUP Online Shopping version 1.0 in the file /admin/productedit.php. Manipulation of the productName argument allows remote script injection. The exploit is publicly available.

In JeecgBoot 3.9.1, the OpenAPI Endpoint component in the file /openapi/call/ has an improper authentication vulnerability. The attack is remote with high complexity, and the vendor did not respond.

A weakness has been identified in jasypt-spring-boot up to version 3.0.5/4.0.4 in the getSecretKeySaltGenerator function of SimpleGCMConfig.java. Manipulation can lead to use of a one-way hash with a predictable salt. The attack can be launched remotely but requires high complexity and is difficult to exploit.

A vulnerability in vBulletin 6.x in an unknown function of the Login component leads to cross-site scripting (XSS). The attack can be initiated remotely. The exploit has been made public.

A security vulnerability has been detected in QuantumNous new-api up to version 0.12.1 in the function RelayMidjourneyImage/GetByOnlyMJId of file router/relay-router.go in the Midjourney Image Relay Endpoint component. Manipulation leads to authorization bypass. The attack can be launched remotely but is difficult.

The NewNTUnicodeString function does not check for string length overflow. When given a string exceeding the maximum NTUnicodeString size (16-bit byte count), it returns a truncated string instead of an error.

In TypeBot up to version 3.15.2, the bot engine's findResult query does not filter by typebotId, allowing an authenticated user to load result data from another typebot by supplying a foreign resultId to the startChat endpoint. This issue is fixed in version 3.16.0.

In Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier, unverified password change allows an attacker to change a user's password without providing the previous one via a crafted password change request.

In Devolutions Server versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier, authorization bypass in the entry duplication feature allows an authenticated user with write access to any vault to copy documentation and attachments from an entry in a vault they cannot access via a crafted save request.

In Devolutions Server, insufficient logging in the entry export feature allows an authenticated user with export permissions to export a sealed entry without triggering the unseal notification to administrators via a crafted export request.

Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request. This affects versions 2026.1.6.0 through 2026.1.16.0 and 2025.3.20.0 and earlier.

Dell PowerFlex Manager versions up to 4.6.2 contain a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH component. A low privileged attacker with local access can bypass protection mechanisms.

Vulnerability in STER prior to version 9.5. The application uses unencrypted TCP traffic to transmit data, enabling Man-In-The-Middle attacks and interception of sensitive data such as passwords or authentication tokens.

A time-of-check time-of-use (TOCTOU) condition in the ad_flush function in Netatalk 3.0.0 through 4.4.2 involves root-privileged file operations, potentially allowing a remote attacker to cause limited data modification under specific race conditions.

A missing break statement in DSI OpenSession processing in Netatalk 1.5.0 through 4.4.2 causes a fall-through from DSIOPT_ATTNQUANT to DSIOPT_SERVQUANT. A remote attacker can cause minor service disruption via crafted DSI session options.

Netatalk 2.1.0 through 4.4.2 combines multiple errno values using bitwise OR, resulting in incorrect error codes when multiple errors occur. A remote attacker can cause minor service disruption via conditions triggering incorrect error handling.