Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
34 results
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-67442 · Other software · frangoteam · reported by GitHubLow 2
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-67443 · Other software · frangoteam · reported by GitHubCritical 9.2
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and use it to access the RED.httpAdmin editor and flow deployment API. Because the Node-RED configuration has no second adminAuth gate, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially operating-system commands when nodeRedUnsafeModules is enabled. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-67440 · Other software · frangoteam · reported by GitHubMedium 6.9
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-65985 · Other software · frangoteam · reported by GitHubMedium 6
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. The attacker can use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints, with impact depending on the FUXA host's deployment network. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-65984 · Other software · frangoteam · reported by GitHubHigh 7.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js re-signs inbound JWT claims without validating the current database record. An attacker who possesses a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion. Continued refresh-cookie rotation can extend the stale session and preserve unauthorized access to user management, project manipulation, runtime configuration, scripts, and backdoor-account creation. This issue is fixed in version 1.3.3.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47721 · Other software · frangoteam · reported by GitHubMedium 6.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47720 · Other software · frangoteam · reported by GitHubMedium 5.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 18, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47719 · Other software · frangoteam · reported by GitHubHigh 8.2
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data reachable from the FUXA host, including when secureEnabled is true. This issue is fixed in version 1.3.2.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47718 · Other software · frangoteam · reported by GitHubMedium 5.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-47717 · Other software · frangoteam · reported by GitHubHigh 7.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 10, 2026A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DACVE-2026-72586 · Other software · frangoteam · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 7.5
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-43947 · Other software · frangoteam · reported by GitHubHigh 8.9
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-43946 · Other software · frangoteam · reported by GitHubHigh 7.7
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-43945 · Other software · frangoteam · reported by GitHubHigh 8.9
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 30, 2026FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API.CVE-2026-13207 · Other software · Frangoteam · reported by ics-cert@hq.dhs.govHigh 8.7
FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by prefixing paths with dot-segments such as /api/./users, /api/./roles, and /api/project/../users. These requests bypass authentication checks and return sensitive user and role data without credentials.
- Product
- FUXA SCADA/HMI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 24, 2026FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).CVE-2025-69985 · Other software · Frangoteam · reported by MITRECritical 9.8
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25951 · Other software · frangoteam · reported by GitHubHigh 8.6
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts. This leads to Remote Code Execution (RCE) when the server reloads the malicious scripts. This vulnerability is fixed in 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25939 · Other software · frangoteam · reported by GitHubCritical 9.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25938 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25895 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25894 · Other software · frangoteam · reported by GitHubCritical 9.5
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25893 · Other software · frangoteam · reported by GitHubCritical 10
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25752 · Other software · frangoteam · reported by GitHubCritical 9.3
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.CVE-2026-25751 · Other software · frangoteam · reported by GitHubCritical 9.1
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Product
- FUXA
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality.CVE-2025-69983 · Other software · Frangoteam · reported by MITRECritical 9.8
FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint.CVE-2025-69981 · Other software · Frangoteam · reported by MITRECritical 9.8
FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js.CVE-2025-69971 · Other software · Frangoteam · reported by MITRECritical 9.8
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 3, 2026FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js.CVE-2025-69970 · Other software · Frangoteam · reported by MITRECritical 9.3
FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.CVE-2023-31719 · Other software · Frangoteam · reported by MITRECritical 9.8
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.CVE-2023-31718 · Other software · Frangoteam · reported by MITREHigh 7.5
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.CVE-2023-31717 · Other software · Frangoteam · reported by MITREHigh 7.5
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 21, 2023FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.logCVE-2023-31716 · Other software · Frangoteam · reported by MITREHigh 7.5
FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2023A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST rCVE-2023-33831 · Other software · Frangoteam · reported by MITRECritical 9.8
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 16, 2022A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal enviroCVE-2021-45851 · Other software · Frangoteam · reported by MITREHigh 7.5
A Server-Side Request Forgery (SSRF) attack in FUXA 1.1.3 can be carried out leading to the obtaining of sensitive information from the server's internal environment and services, often potentially leading to the attacker executing commands on the server.
- Product
- Fuxa
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordyoutube.comyoutube.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.