CVE Program partner

MHV

Maritime Hacking Village

API
CVEs, 365 days1111 all time, 0 rejected
Quality100%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions100%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationMaritime Hacking Village
RoleCNA
TypeResearcher
Reports toicscert → CISA
ScopeVulnerabilities discovered by researchers in collaboration with Maritime Hacking Village that are not in another CNA’s scope.
Advisorieshttps://maritimehackingvillage.com/security-advisory

Latest CVEs · RSS

  • CVE-2026-2754 2026-03-06 · CVSS 7.5
    Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with
  • CVE-2026-2753 2026-03-06 · CVSS 7.5
    An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path inp
  • CVE-2026-2752 2026-03-06 · CVSS 5.3
    Navtor NavBox allows information disclosure via the /api/ais-data endpoint. A remote, unauthenticated attacker can send crafted requests to trigger an unhandled
  • CVE-2026-2249 2026-02-11 · CVSS 9.8
    METIS DFS devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoi
  • CVE-2026-2248 2026-02-11 · CVSS 9.8
    METIS WIC devices (versions <= oscore 2.1.234-r18) expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoi
  • CVE-2026-2250 2026-02-11 · CVSS 7.5
    The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite databa
  • CVE-2026-22240 2026-01-14 · CVSS 10.0
    The vulnerability exists in BLUVOYIX due to an improper password storage implementation and subsequent exposure via unauthenticated APIs. An unauthenticated rem
  • CVE-2026-22239 2026-01-14 · CVSS 10.0
    The vulnerability exists in BLUVOYIX due to design flaws in the email sending API. An unauthenticated remote attacker could exploit this vulnerability by sendin
  • CVE-2026-22238 2026-01-14 · CVSS 10.0
    The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX admin APIs. An unauthenticated remote attacker could exploit this vulnerabil
  • CVE-2026-22237 2026-01-14 · CVSS 10.0
    The vulnerability exists in BLUVOYIX due to the exposure of sensitive internal API documentation. An unauthenticated remote attacker could exploit this vulnerab
  • CVE-2026-22236 2026-01-14 · CVSS 10.0
    The vulnerability exists in BLUVOYIX due to improper authentication in the BLUVOYIX backend APIs. An unauthenticated remote attacker could exploit this vulnerab

All CVE Program partners