2
CVEs
0
Critical
2
High
0
KEV
0
PoC
1
Unpatched C/H
50.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
2
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (5)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-13207 | Authentication bypass in FUXA SCADA/HMI versions 1.3.1 and prior lets remote unauthenticated attackers reach protected REST API endpoints by inserting dot-segment sequences (e.g. /api/./users, /api/project/../users) that the router fails to normalize before applying its authentication middleware. Successful exploitation returns sensitive user and role data without any credentials. No public exploit identified at time of analysis, though the technique is trivially reproducible and the issue is documented in a CISA ICS advisory (ICSA-26-181-02). | HIGH | 8.7 | 0.4% | 54 |
No patch
|
| CVE-2026-72586 | Unauthenticated access to complete historical sensor data is possible in FUXA through version 1.3.3 because the DAQ_QUERY Socket.IO event handler in server/runtime/index.js omits the isSocketAdminAuthorized() check that guards every other sensitive Socket.IO event. Remote attackers can exfiltrate all sensor history without credentials even on deployments where secureEnabled=true is configured, silently undermining an operator's assumption that authentication is fully enforced. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS AV:N/AC:L/PR:N vector confirms this is trivially exploitable by any network-reachable party. | HIGH | 7.5 | 0.4% | 38 |
|