Vulnerabilities

TI-2026-70023 CVE-2026-104629 · GHSA-68jv-q5j2-rgqm

Unsafe reflection in Grid Protection Alliance openPDC and openHistorian

LOW 36

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00337 Published 2026-10-09 Fixed in 2.9.477, 2.9.482 +2 CWE-470

TI-2026-70018 CVE-2026-101022 · GHSA-q8fp-gfvc-6mwj

Server-side request forgery in openPDC and openHistorian

LOW 23

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00186 Published 2026-10-09 Fixed in 2.9.477, 2.9.482 +2 CWE-918

TI-2026-70004 CVE-2026-85479 · GHSA-xr5w-f3rm-m5gq

Missing authentication in openPDC and openHistorian data publisher

LOW 36

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00252 Published 2026-10-09 Fixed in 2.9.477, 2.9.482 +2 CWE-306

TI-2026-70024 CVE-2026-105281 · GHSA-cg72-3fmm-q6mm

Missing authentication in Grid Protection Alliance openPDC and openHistorian

MEDIUM 43

The internal data publisher on openPDC accepts network connections without authentication in its default configuration.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00312 Published 2026-10-09 Fixed in 2.9.477, 2.9.482 +2 CWE-306

TI-2026-70017 CVE-2026-100730 · GHSA-g2gc-jv32-q89f

Untrusted data deserialization in openPDC and openHistorian

MEDIUM 49

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00625 Published 2026-10-09 Fixed in 2.9.477, 2.9.482 +2 CWE-502