Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8 results
Jan 7, 2026As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCVE-2026-22539 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Medium 5.3
As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via OCPP v1.6.
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026An attacker with a network connection could detect credentials in clear text.CVE-2026-22544 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6High 8.7
An attacker with a network connection could detect credentials in clear text.
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026The credentials required to access the device's web server are sent in base64 within the HTTP headers.CVE-2026-22543 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Medium 6.9
The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attacker could intercept the web request handling the login and obtain the credentials
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuCVE-2026-22537 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Medium 6.8
The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valuable information for an attacker.
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictionsCVE-2026-22536 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6High 8.6
The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protoCVE-2026-22535 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6High 8.9
An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications protocol, write on the server topics of the board that controls the MQTT communications
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet serCVE-2026-22542 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6Critical 9.2
An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet service.
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces.CVE-2026-22541 · Other software · EFACEC · reported by 50b5080a-775f-442e-83b5-926b5ca517b6High 8.2
The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board must be operating correctly for the charger to also function correctly.
- Product
- QC 60/90/120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.