CVE Program partner

DIVD

Dutch Institute for Vulnerability Disclosure (DIVD)

API
CVEs, 365 days26112 all time, 1 rejected
Quality92%median 99%
CVSS by the CNA100%share of records
CWE76%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationDutch Institute for Vulnerability Disclosure (DIVD)
RoleCNA
TypeResearcher
Reports toENISA → mitre
ScopeVulnerabilities in software discovered by DIVD, and vulnerabilities reported to DIVD for coordinated disclosure, which are not in another CNA’s scope.
Advisorieshttps://csirt.divd.nl/cves/

Latest CVEs · RSS

  • CVE-2026-102490 2026-09-30 · CVSS 8.5
    Zammad packages built with packager.io (DEB and RPM) could have allowed a local attacker who already had file system write privileges as the unprivileged zammad
  • CVE-2026-102489 2026-09-30 · CVSS 8.7
    Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the zammad user. The bug is also present in
  • CVE-2026-22094 2026-09-29 · CVSS 9.3
    The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network
  • CVE-2026-22101 2026-09-29 · CVSS 5.1
    The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addres
  • CVE-2026-22104 2026-07-17 · CVSS 7.1
    Improper access control in Hashtopolis server web-interface chunk activity component for versions prior to 0.14.8 allows any created account to read all cracked
  • CVE-2026-22103 2026-07-13 · CVSS 9.3
    The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.
  • CVE-2026-22098 2026-07-13 · CVSS 9.2
    Various sensitive information such as passwords and charging card UIDs are written to log files.
  • CVE-2026-22097 2026-07-13 · CVSS 9.3
    The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload ar
  • CVE-2026-22099 2026-07-13 · CVSS 8.7
    The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage
  • CVE-2026-22102 2026-07-13 · CVSS 9.3
    A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Conten
  • CVE-2026-22096 2026-07-13 · CVSS 9.3
    The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading fil
  • CVE-2026-22100 2026-07-13 · CVSS 8.6
    The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root.
  • CVE-2026-22095 2026-07-13 · CVSS 9.3
    The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.
  • CVE-2026-22093 2026-07-13 · CVSS 9.5
    The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on
  • CVE-2025-36747 2025-12-13 · CVSS 9.4
    ShineLan-X contains a set of credentials for an FTP server was found within the firmware, allowing testers to establish an insecure FTP connection with the serv
  • CVE-2025-36752 2025-12-13 · CVSS 9.4
    Growatt ShineLan-X communication dongle has an undocumented backup account with undocumented credentials which allows significant level access to the device, su
  • CVE-2025-36754 2025-12-13 · CVSS 9.3
    The authentication mechanism on web interface is not properly implemented. It is possible to bypass authentication checks by crafting a post request with new se
  • CVE-2025-36748 2025-12-13 · CVSS 8.4
    ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the local configuration web server. The JavaScript code snippet can be inserted in the
  • CVE-2025-36750 2025-12-13 · CVSS 8.5
    ShineLan-X contains a stored cross site scripting (XSS) vulnerability in the Plant Name field. A HTML payload will be displayed on the plant management page via
  • CVE-2025-36753 2025-12-13 · CVSS 8.6
    The SWD debug interface on the Growatt ShineLan-X communication dongle is available by default, allowing an attacker to attain debug access to the device and to
  • CVE-2025-36751 2025-12-13 · CVSS 9.4
    Encryption is missing on the configuration interface for Growatt ShineLan-X and MIC 3300TL-X. This allows an attacker with access to the network to intercept an
  • CVE-2025-36746 2025-12-12 · CVSS 4.8
    SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may execu
  • CVE-2025-36743 2025-12-12 · CVSS 8.6
    SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and execution of debug comma
  • CVE-2025-36744 2025-12-12 · CVSS 2.4
    SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop. While the device repeatedly initializes and waits for boot
  • CVE-2025-36745 2025-12-12 · CVSS 8.6
    SolarEdge SE3680H  ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems. An attacker with network or local access can exp

All CVE Program partners