CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,488 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,488
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product frangoteam:fuxa. Show all products

24 CVEs, showing 1 to 24
CVESeverityTitlePublished
CVE-2025-69970Critical 9.3FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js.Feb 3, 2026
CVE-2025-69971Critical 9.8FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js.Feb 3, 2026
CVE-2025-69981Critical 9.8FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint.Feb 3, 2026
CVE-2025-69983Critical 9.8FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality.Feb 3, 2026
CVE-2026-25751High 7.5FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.Feb 6, 2026
CVE-2026-25752Critical 9.1FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.Feb 6, 2026
CVE-2026-25893Critical 9.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.Feb 9, 2026
CVE-2026-25894Critical 9.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.Feb 9, 2026
CVE-2026-25895Critical 9.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.Feb 9, 2026
CVE-2026-25938Critical 9.8FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.Feb 9, 2026
CVE-2026-25939Critical 9.1FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.Feb 9, 2026
CVE-2026-25951High 7.2FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.Feb 9, 2026
CVE-2025-69985Critical 9.8FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).Feb 24, 2026
CVE-2026-72586High 7.5frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
Assigned by TuranSec
Aug 10, 2026
CVE-2026-47717High 7.5FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-47718Medium 5.5FUXA provides guest and invalid-token access to protected read APIs in secure mode
Assigned by GitHub_M
Aug 12, 2026
CVE-2026-47720Medium 5.3FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-47719High 8.2FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-47721Medium 6.3FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-67440Medium 6.9FUXA: Unauthenticated Socket.IO read events
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-65985Medium 6.0FUXA: SSRF hardening for `device-webapi-request`
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-67443Critical 9.2FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-65984High 7.5FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions
Assigned by GitHub_M
Aug 18, 2026
CVE-2026-67442Low 2.0FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup
Assigned by GitHub_M
Aug 18, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.