Vulnerabilities

TI-2026-82272 CVE-2026-42949 · GHSA-rhmc-8mq6-cwpm

Authorization bypass in FUXA /api/runscript endpoint

LOW 27

A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809).

CVSS 3.1MEDIUM 5.6 Network No auth No interaction EPSS 0.00221 Published 2026-10-29 No fix listed CWE-285

TI-2026-82270 CVE-2026-40063 · GHSA-q75x-9g48-hq38

Information disclosure in FUXA scripts endpoint

LOW 30

A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809).

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00288 Published 2026-10-29 No fix listed CWE-200

TI-2026-82271 CVE-2026-42922 · GHSA-24fv-gm68-rm6q

Authorization bypass in FUXA /nodered allows arbitrary code execution

MEDIUM 50

A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00534 Published 2026-10-29 No fix listed CWE-285

TI-2026-47721 CVE-2026-67442

FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup

LOW 11

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 3.1LOW 2.0 Network High privileges User interaction EPSS 0.00324 Published 2026-08-18 Fixed in 1.3.3 CWE-284

TI-2026-46995 CVE-2026-65984

FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

LOW 33

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00515 Published 2026-08-18 Fixed in 1.3.3 CWE-613

TI-2026-47722 CVE-2026-67443

FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

MEDIUM 43

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00686 Published 2026-08-18 Fixed in 1.3.3 CWE-862

TI-2026-46996 CVE-2026-65985

FUXA: SSRF hardening for `device-webapi-request`

LOW 27

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00465 Published 2026-08-18 Fixed in 1.3.3 CWE-918

TI-2026-47720 CVE-2026-67440

FUXA: Unauthenticated Socket.IO read events

LOW 31

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0054 Published 2026-08-18 Fixed in 1.3.3 CWE-862

TI-2026-35222 CVE-2026-47721 · GHSA-8ghr-w65f-j3qr

FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

LOW 28

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00434 Published 2026-08-18 Fixed in 1.3.2 CWE-862

TI-2026-35220 CVE-2026-47719 · GHSA-w86f-rf9w-h3x6

FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

HIGH 75

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00592 Published 2026-08-18 Fixed in 1.3.2 CWE-918

TI-2026-35221 CVE-2026-47720 · GHSA-h9fj-c2qr-76g2

FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString

LOW 31

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00641 Published 2026-08-18 Fixed in 1.3.2 CWE-89

TI-2026-35219 CVE-2026-47718 · GHSA-r9g5-7q8j-958c

FUXA provides guest and invalid-token access to protected read APIs in secure mode

MEDIUM 64

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.00458 Published 2026-08-12 Fixed in 1.3.1 CWE-287

TI-2026-35218 CVE-2026-47717 · GHSA-q3w6-q3hc-c5x6

FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

HIGH 72

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01375 Published 2026-08-12 Fixed in 1.3.1 CWE-201

TI-2026-50843 CVE-2026-72586 · GHSA-fcm7-v7r7-pvhr

frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

MEDIUM 40

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00633 Published 2026-08-10 No fix listed CWE-306

TI-2026-32004 CVE-2026-43947 · GHSA-rg3m-cfq7-g6h6

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

HIGH 80

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00911 Published 2026-07-21 Fixed in 1.3.1 CWE-863

TI-2026-32003 CVE-2026-43946 · GHSA-fwcm-rqvw-j3p7

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

HIGH 73

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00567 Published 2026-07-21 Fixed in 1.3.1 CWE-863

TI-2026-32002 CVE-2026-43945 · GHSA-p69w-mmfv-xrfj

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

MEDIUM 48

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00839 Published 2026-07-21 Fixed in 1.3.1 CWE-284

TI-2026-11214 CVE-2026-13207 · GHSA-cgxf-x59w-2x25

Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing

MEDIUM 45

FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00609 Published 2026-06-30 Fixed in 1.3.2 CWE-290

TI-2025-42978 CVE-2025-69985 · GHSA-4r4r-4jp4-wwf9

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote…

HIGH 82

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.06021 Published 2026-02-24 No fix listed CWE-288

TI-2026-20934 CVE-2026-25895 · GHSA-88qh-cphv-996c

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

MEDIUM 57

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.1285 Published 2026-02-09 Fixed in 1.2.10 CWE-22

TI-2026-20933 CVE-2026-25894 · GHSA-32cc-x95p-fxcg

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

MEDIUM 44

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00842 Published 2026-02-09 Fixed in 1.2.10 CWE-1188

TI-2026-20932 CVE-2026-25893 · GHSA-vwcg-c828-9822

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

MEDIUM 50

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00758 Published 2026-02-09 Fixed in 1.2.10 CWE-285

TI-2026-20976 CVE-2026-25951 · GHSA-68m5-5w2h-h837

FUXA has a Path Traversal Sanitization Bypass

MEDIUM 42

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01349 Published 2026-02-09 Fixed in 1.2.11 CWE-184

TI-2026-20969 CVE-2026-25939 · GHSA-c869-jx4c-q5fc

FUXA Unauthenticated Remote Arbitrary Scheduler Write

MEDIUM 62

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.12536 Published 2026-02-09 Fixed in 1.2.11 CWE-862

TI-2026-20968 CVE-2026-25938 · GHSA-v4p5-w6r3-2x4f

FUXA Unauthenticated Remote Code Execution in Node-RED Integration

MEDIUM 51

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.01057 Published 2026-02-09 Fixed in 1.2.11 CWE-290

Vulnerabilities

Filters