TI-2026-70017 CVE-2026-100730 · GHSA-g2gc-jv32-q89f
Untrusted data deserialization in openPDC and openHistorian
Priority MEDIUM 49
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure.
Grid Protection Alliance
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Grid Protection Alliance records in CISA KEVNo Grid Protection Alliance vulnerabilities are listed in CISA KEV.
Records
6 records
TI-2026-70024 CVE-2026-105281 · GHSA-cg72-3fmm-q6mm
Missing authentication in Grid Protection Alliance openPDC and openHistorian
Priority MEDIUM 43
The internal data publisher on openPDC accepts network connections without authentication in its default configuration.
Priority MEDIUM 42
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use.
TI-2026-70023 CVE-2026-104629 · GHSA-68jv-q5j2-rgqm
Unsafe reflection in Grid Protection Alliance openPDC and openHistorian
Priority LOW 36
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load.
TI-2026-70004 CVE-2026-85479 · GHSA-xr5w-f3rm-m5gq
Missing authentication in openPDC and openHistorian data publisher
Priority LOW 36
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration.
TI-2026-70018 CVE-2026-101022 · GHSA-q8fp-gfvc-6mwj
Server-side request forgery in openPDC and openHistorian
Priority LOW 23
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted.