4
CVEs
3
Critical
1
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
3
HIGH
1
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (1)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-62928 | Unauthenticated OS command injection in XING Inc.'s CPTrans-ME-X allows remote attackers to inject and execute arbitrary operating-system commands on the device without any credentials. The flaw (CWE-78) carries a CVSS 4.0 base score of 9.3 with full confidentiality, integrity, and availability impact, meaning a successful attacker gains complete control of the affected unit. No public exploit identified at time of analysis, and the device is not listed in CISA KEV. | CRITICAL | 9.3 | 1.2% | 48 |
|
| CVE-2026-69657 | Unauthenticated remote device takeover in XING (XING Inc./JOYSOUND) CPTrans-ME-X arises from a shipped default password (CWE-1393) that anyone aware of the credential can use to log in with full privileges. The flaw affects all firmware revisions of this Japanese commercial audio/video rack transmission accessory and grants complete control over confidentiality, integrity, and availability. No public exploit code has been identified, and it is not on CISA KEV, but the trivial nature of default-credential abuse makes exploitation straightforward once the credential is known. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-70403 | Unauthenticated device login in XING Inc.'s CPTrans-ME-X AV signal-transport appliance is possible via a hard-coded password (CWE-259): anyone who knows the built-in credential can authenticate over the network and gain full control of the device. The flaw was coordinated through JPCERT/CC (JVN JVN32505330) and carries a CVSS 4.0 base score of 9.3 with high confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and the product is niche, but the fixed credential makes exploitation trivial once the value is known. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-66840 | Sensitive system information exposure in XING CPTrans-ME-X (a rack-mounted accessory from XING Inc., distributed under the JOYSOUND product ecosystem) allows unauthenticated remote attackers to retrieve confidential system details over the network without any privileges or user interaction. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the vulnerability was reported by JPCERT and documented in JVN advisory JVN#32505330. No public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network attack vector makes opportunistic probing accessible to low-skilled actors if the device is network-reachable. | HIGH | 8.7 | 0.3% | 44 |
|