https://vulnogram.org/ Most recent CVEs assigned by Dragos, Inc. (dragos). https://vulnogram.org/seaview/icons/dragos.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2025-64124 https://vulnogram.org/CVE-2025-64124 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): before 2.5.1. High Sat, 03 Jan 2026 00:28:24 GMT https://vulnogram.org/CVE-2025-64125 https://vulnogram.org/CVE-2025-64125 A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End users do not have to take any action to mitigate the issue. Critical Sat, 03 Jan 2026 00:21:20 GMT https://vulnogram.org/CVE-2025-64123 https://vulnogram.org/CVE-2025-64123 Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): through and including release 2.5.1. High Network Exploitable Fri, 02 Jan 2026 21:41:25 GMT https://vulnogram.org/CVE-2025-64122 https://vulnogram.org/CVE-2025-64122 Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Multi-Stack Controller (MSC): through 2.5.1. High Fri, 02 Jan 2026 21:39:26 GMT https://vulnogram.org/CVE-2025-64121 https://vulnogram.org/CVE-2025-64121 Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1. Critical Network Exploitable Fri, 02 Jan 2026 21:35:53 GMT https://vulnogram.org/CVE-2025-64120 https://vulnogram.org/CVE-2025-64120 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.… Critical Fri, 02 Jan 2026 21:33:23 GMT https://vulnogram.org/CVE-2025-64119 https://vulnogram.org/CVE-2025-64119 A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9. Critical Network Exploitable Fri, 02 Jan 2026 21:26:57 GMT https://vulnogram.org/CVE-2025-7676 https://vulnogram.org/CVE-2025-7676 DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL in the same directory as the executable. Vulnerable versions of Windows 11 for ARM attempt… Medium Mon, 28 Jul 2025 16:34:28 GMT https://vulnogram.org/CVE-2025-53696 https://vulnogram.org/CVE-2025-53696 iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may contain malicious code. Tested up to firmware 6.9.2, later firmwares are also possibly affected… Critical Mon, 28 Jul 2025 14:43:01 GMT https://vulnogram.org/CVE-2025-53695 https://vulnogram.org/CVE-2025-53695 OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device firmware. Critical Mon, 28 Jul 2025 14:05:36 GMT https://vulnogram.org/CVE-2024-1480 https://vulnogram.org/CVE-2024-1480 Unitronics Vision Standard line of controllers allow the Information Mode password to be retrieved without authentication. High Network Exploitable Fri, 19 Apr 2024 21:19:27 GMT https://vulnogram.org/CVE-2022-45792 https://vulnogram.org/CVE-2022-45792 Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting files with the privileges of the logged-in user. High Mon, 22 Jan 2024 17:46:36 GMT https://vulnogram.org/CVE-2022-45790 https://vulnogram.org/CVE-2022-45790 The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow an adversary to gain access to protected memory. This access can allow overwrite of values i… High Network Exploitable Mon, 22 Jan 2024 17:22:14 GMT https://vulnogram.org/CVE-2022-45794 https://vulnogram.org/CVE-2022-45794 An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC internal memory and memory card. High Network Exploitable Wed, 10 Jan 2024 22:56:58 GMT https://vulnogram.org/CVE-2022-45793 https://vulnogram.org/CVE-2022-45793 Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result in code execution with privileges of a different user. Medium Wed, 10 Jan 2024 20:49:36 GMT https://vulnogram.org/CVE-2023-29447 https://vulnogram.org/CVE-2023-29447 An insufficiently protected credentials vulnerability in KEPServerEX could allow an adversary to capture user credentials as the web server uses basic authentication. Medium Wed, 10 Jan 2024 20:24:52 GMT https://vulnogram.org/CVE-2023-29446 https://vulnogram.org/CVE-2023-29446 An improper input validation vulnerability has been discovered that could allow an adversary to inject a UNC path via a malicious project file. This allows an adversary to capture NLTMv2 hashes and potentially crack them offline. Medium Wed, 10 Jan 2024 20:21:51 GMT https://vulnogram.org/CVE-2023-29445 https://vulnogram.org/CVE-2023-29445 An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. High Wed, 10 Jan 2024 20:17:12 GMT https://vulnogram.org/CVE-2023-29444 https://vulnogram.org/CVE-2023-29444 An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick v… Medium Wed, 10 Jan 2024 17:06:35 GMT https://vulnogram.org/CVE-2023-40710 https://vulnogram.org/CVE-2023-40710 An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured… Medium Network Exploitable Thu, 24 Aug 2023 16:09:25 GMT https://vulnogram.org/CVE-2023-40709 https://vulnogram.org/CVE-2023-40709 An adversary could crash the entire device by sending a large quantity of ICMP requests if the controller has the built-in web server enabled but does not have the built-in web server completely set up and configured for the SNAP PAC S1 Firmware vers… Medium Network Exploitable Thu, 24 Aug 2023 16:08:47 GMT https://vulnogram.org/CVE-2023-40708 https://vulnogram.org/CVE-2023-40708 The File Transfer Protocol (FTP) port is open by default in the SNAP PAC S1 Firmware version R10.3b. This could allow an adversary to access some device files. Medium Network Exploitable Thu, 24 Aug 2023 16:08:23 GMT https://vulnogram.org/CVE-2023-40707 https://vulnogram.org/CVE-2023-40707 There are no requirements for setting a complex password in the built-in web server of the SNAP PAC S1 Firmware version R10.3b, which could allow for a successful brute force attack if users don't set up complex credentials. High Network Exploitable Thu, 24 Aug 2023 16:05:48 GMT https://vulnogram.org/CVE-2023-40706 https://vulnogram.org/CVE-2023-40706 There is no limit on the number of login attempts in the web server for the SNAP PAC S1 Firmware version R10.3b. This could allow for a brute-force attack on the built-in web server login. High Network Exploitable Thu, 24 Aug 2023 16:03:36 GMT