THA-PSIRT

Reports to THA-PSIRT (2)

Latest CVEs (this partner and the CNAs under it) · RSS

• CVE-2026-18397 2026-10-01 · CVSS 9.4
  This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory
• CVE-2026-18825 2026-09-28 · TCS-CERT · CVSS 5.3
  An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross domain authen
• CVE-2026-19614 2026-09-08 · TCS-CERT · CVSS 5.3
  The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2.3.
• CVE-2026-9007 2026-07-15 · TCS-CERT · CVSS 5.5
  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in HCL Notes from HCL Software allows reflected Cross-Site
• CVE-2026-13014 2026-07-13 · CVSS 9.2
  A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrit
• CVE-2026-6805 2026-05-07 · CVSS 6.9
  Vulnerability on the external sharing feature in Cryptobox allows an attacker knowing a sharing link URL to retrieve information from the server allowing an off
• CVE-2026-6501 2026-05-04 · TCS-CERT · CVSS 5.3
  Improper restriction of XML external entity reference vulnerability in ILM Informatique jOpenDocument allows Data Serialization External Entities Blowup. This
• CVE-2026-6500 2026-05-04 · TCS-CERT · CVSS 4.8
  Plaintext storage of a password vulnerability in ILM Informatique OpenConcerto allows Retrieve Embedded Sensitive Data. This issue affects OpenConcerto: 1.7.5.
• CVE-2026-6499 2026-05-04 · TCS-CERT · CVSS 2.4
  Incorrect Permission Assignment for Critical Resource vulnerability in ILM Informatique OpenConcerto allows Replace Binaries. This issue affects OpenConcerto:
• CVE-2026-5794 2026-04-28 · CVSS 4.9
  A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a
• CVE-2026-3457 2026-03-27 · CVSS 7.0
  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sentinel LDK Runtime on Windows allows Store
• CVE-2026-0872 2026-02-13 · CVSS 2.5
  Improper Certificate Validation vulnerability in Thales SafeNet Agent for Windows Logon on Windows allows Signature Spoofing by Improper Validation. This issue
• CVE-2026-2344 2026-02-11 · TCS-CERT · CVSS 8.6
  A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessMan
• CVE-2026-2337 2026-02-11 · TCS-CERT · CVSS 8.7
  A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issue affects Plunet Busi
• CVE-2026-0873 2026-02-04 · CVSS 4.8
  On a Cryptobox platform where administrator segregation based on entities is used, some vulnerabilities in Ercom Cryptobox administration console allows an auth
• CVE-2026-22539 2026-01-07 · S21sec · CVSS 5.3
  As the service interaction is performed without authentication, an attacker with some knowledge of the protocol could obtain information about the charger via O
• CVE-2026-22537 2026-01-07 · S21sec · CVSS 6.8
  The lack of hardening of the system allows the user used to manage and maintain the charger to consult different files containing clear-text credentials or valu
• CVE-2026-22536 2026-01-07 · S21sec · CVSS 8.6
  The absence of permissions control for the user XXX allows the current configuration in the sudoers file to escalate privileges without any restrictions
• CVE-2026-22535 2026-01-07 · S21sec · CVSS 8.9
  An attacker with the ability to interact through the network and with access credentials, could, thanks to the unsecured (unencrypted) MQTT communications proto
• CVE-2026-22544 2026-01-07 · S21sec · CVSS 8.7
  An attacker with a network connection could detect credentials in clear text.
• CVE-2026-22543 2026-01-07 · S21sec · CVSS 6.9
  The credentials required to access the device's web server are sent in base64 within the HTTP headers. Since base64 is not considered a strong cipher, an attack
• CVE-2026-22542 2026-01-07 · S21sec · CVSS 9.2
  An attacker with access to the system's internal network can cause a denial of service on the system by making two concurrent connections through the Telnet ser
• CVE-2026-22541 2026-01-07 · S21sec · CVSS 8.2
  The massive sending of ICMP requests causes a denial of service on one of the boards from the EVCharger that allows control the EV interfaces. Since the board m
• CVE-2026-22540 2026-01-07 · S21sec · CVSS 9.2
  The massive sending of ARP requests causes a denial of service on one board of the charger that allows control of the EV interfaces. Since the board must be ope
• CVE-2025-15479 2026-01-07 · TCS-CERT · CVSS 5.1
  Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on