https://vulnogram.org/ Most recent CVEs assigned by Maritime Hacking Village (mhv). https://vulnogram.org/seaview/icons/mhv.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:08 GMT https://vulnogram.org/CVE-2026-2754 https://vulnogram.org/CVE-2026-2754 Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve in… High Network Exploitable Fri, 06 Mar 2026 15:05:20 GMT https://vulnogram.org/CVE-2026-2753 https://vulnogram.org/CVE-2026-2753 An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests contain… High Network Exploitable Fri, 06 Mar 2026 15:04:47 GMT https://vulnogram.org/CVE-2026-2752 https://vulnogram.org/CVE-2026-2752 Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled exception, causing the server to return verbose .NET stack traces. These error messages e… Medium Network Exploitable Fri, 06 Mar 2026 15:04:20 GMT https://vulnogram.org/CVE-2026-2249 https://vulnogram.org/CVE-2026-2249 METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with 'daemon' p… Critical Network Exploitable Wed, 11 Feb 2026 14:16:19 GMT https://vulnogram.org/CVE-2026-2248 https://vulnogram.org/CVE-2026-2248 METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root (UID… Critical Network Exploitable Wed, 11 Feb 2026 14:15:42 GMT https://vulnogram.org/CVE-2026-2250 https://vulnogram.org/CVE-2026-2250 The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with… High Network Exploitable Wed, 11 Feb 2026 14:13:45 GMT https://vulnogram.org/CVE-2026-22240 https://vulnogram.org/CVE-2026-22240 The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests t… Critical Network Exploitable Wed, 14 Jan 2026 14:42:09 GMT https://vulnogram.org/CVE-2026-22239 https://vulnogram.org/CVE-2026-22239 The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable email sending API. Successful exploita… Critical Network Exploitable Wed, 14 Jan 2026 14:40:20 GMT https://vulnogram.org/CVE-2026-22238 https://vulnogram.org/CVE-2026-22238 The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable admin API to create a new… Critical Network Exploitable Wed, 14 Jan 2026 14:38:55 GMT https://vulnogram.org/CVE-2026-22237 https://vulnogram.org/CVE-2026-22237 The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the APIs exposed by the documentation.… Critical Network Exploitable Wed, 14 Jan 2026 14:36:47 GMT https://vulnogram.org/CVE-2026-22236 https://vulnogram.org/CVE-2026-22236 The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable APIs. Successful exploi… Critical Network Exploitable Wed, 14 Jan 2026 14:34:14 GMT