frangoteam vulnerabilities

Newest CVEs

• CVE-2026-42949

  A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to…

  frangoteam · Frangoteam

  Medium5.6
• CVE-2026-40063

  A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can…

  frangoteam · Frangoteam

  Medium5.3
• CVE-2026-42922

  A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a…

  frangoteam · Frangoteam

  Critical9.8
• CVE-2026-67442

  FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup

  frangoteam · FUXA

  Low2.0
• CVE-2026-65984

  FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

  frangoteam · FUXA

  High7.5
• CVE-2026-67443

  FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

  frangoteam · FUXA

  Critical9.2
• CVE-2026-65985

  FUXA: SSRF hardening for `device-webapi-request`

  frangoteam · FUXA

  Medium6.0
• CVE-2026-67440

  FUXA: Unauthenticated Socket.IO read events

  frangoteam · FUXA

  Medium6.9
• CVE-2026-47721

  FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

  frangoteam · FUXA

  Medium6.3
• CVE-2026-47719

  FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

  frangoteam · FUXA

  High8.2