CVE-2025-66588

Access of Uninitialized Pointer vulnerability in AzeoTech DAQFactory

In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized pointer vulnerability can be exploited by an attacker which can lead to arbitrary code execution.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Azeotech

Products

Daqfactory

CVE-2026-10796

nvm executes commands from a malicious Node.js mirror's version strings

nvm (Node Version Manager) through 0.40.4 executes arbitrary commands from version strings supplied by the configured Node.js/io.js mirror. Commands such as `nvm install` read the available versions from the mirror's index.tab and use the selected version, without sanitization, to build download URLs and shell/awk commands. Two sinks are affected by the same untrusted input: nvm_download() built a curl/wget command string and ran it with `eval`, so a version field containing command substitution (for example $(id)) was executed by the local shell; and nvm_get_checksum() interpolated the version-derived download slug into an awk program, so a crafted version could execute arbitrary commands via awk's system(). An attacker who controls the configured mirror, supplies mirror content to a user or CI on a non-default mirror, or machine-in-the-middles a non-TLS mirror can ∴ run arbitrary commands with the privileges of the user running nvm. The default mirror (https://nodejs.org over TLS) is not affected. Fixed on master (pending the next tagged release) by passing every argument as a literal argv element instead of using eval, by passing the value to awk as data via -v instead of interpolating it into the program, and by rejecting any version outside the Node.js/io.js version grammar before it is used.

CVSS 4.0 · 7.5 High EPSS 5.0% KEV · Not listed

Vendors

Nvm-sh Openjsf

Products

Nvm Node Version Manager

CVE-2025-66586

Type Confusion vulnerability in AzeoTech DAQFactory

In AzeoTech DAQFactory release 20.7 (Build 2555), an access of resource using incompatible type vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Azeotech

Products

Daqfactory

CVE-2025-14771

File Disclosure in ABB T-MAC Plus web application and in ABB T-MAC plus Server - Default IIS Web Site

Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

T-mac Plus

CVE-2025-14772

Broken Access Control in ABB T-MAC Plus web application

Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

T-mac Plus

CVE-2025-66585

Use After Free vulnerability in AzeoTech DAQFactory

In AzeoTech DAQFactory release 20.7 (Build 2555), a use after free vulnerability can be exploited to cause memory corruption while parsing specially crafted .ctl files. This could allow an attacker to execute code in the context of the current process.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Azeotech

Products

Daqfactory

CVE-2025-14773

Stored Cross-Site Scripting in ABB T-MAC Plus web application

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

T-mac Plus

CVE-2025-14774

Communication analysis between the Card Reader and TP2CardReaderService daemon

Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Abb

Products

T-mac Plus

CVE-2025-12659

Heap-based buffer overflow in Siemens Simcenter Femap

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Siemens

Products

Simcenter Femap

CVE-2026-49448

authentik: SourceStage bypass via empty POST

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, the Source stage can be bypassed by sending an empty POST. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Goauthentik

Products

Authentik

CVE-2026-49443

authentik: `UserSourceConnection.user` and `GroupSourceConnection.group` are changeable through the API

authentik is an open-source identity provider. Prior to versions 2025.12.6, 2026.2.4, and 2026.5.1, an attacker with the ability to change a source connection, and an account in one of the configured sources can log into any account. This issue has been patched in versions 2025.12.6, 2026.2.4, and 2026.5.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Goauthentik

Products

Authentik

CVE-2026-47201

authentik: XML Signature Wrapping in SAML Source ACS allows authentication as arbitrary federated user

authentik is an open-source identity provider. Prior to versions 2025.12.5, 2026.2.3, and 2026.5.1, authentik's SAML Source ACS endpoint is vulnerable to XML Signature Wrapping when validating upstream SAML responses. An attacker with any account at the upstream IdP can reuse a valid signed assertion to authenticate as another federated user. This issue has been patched in versions 2025.12.5, 2026.2.3, and 2026.5.1.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Goauthentik

Products

Authentik

CVE-2026-1341

Missing Authentication for Critical Function in Avation Light Engine Pro

Avation Light Engine Pro exposes its configuration and control interface without any authentication or access control.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Avation

Products

Light Engine Pro

CVE-2025-54808

Oxford Nanopore Technologies MinKNOW Insufficiently Protected Credentials

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory (/tmp) on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the token is leaked (e.g., via malware infection or other local exploit), and remote access is enabled, it can be used to establish unauthorized remote connections to the sequencer. Remote access must be enabled for remote exploitation to succeed. This may occur either because the user has enabled remote access for legitimate operational reasons or because malware with elevated privileges (e.g., sudo access) enables it without user consent. This vulnerability can be chained with remote access capabilities to generate a developer token from a remote device. Developer tokens can be created with arbitrary expiration dates, enabling persistent access to the sequencer and bypassing standard authentication mechanisms.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Nanoporetech Oxford Nano Technologies

Products

Minknow Minknow

CVE-2026-42849

authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover

authentik is an open-source identity provider. Prior to versions 2025.12.5 and 2026.2.3, due to the implementation of stages in the SFE (Simple Flow Executor) in order to make the interface more compatible with legacy browsers, it was possible to use an XSS exploit in the AutosubmitStage. This issue has been patched in versions 2025.12.5 and 2026.2.3.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Goauthentik

Products

Authentik

CVE-2025-54807

Dover Fueling Solutions ProGauge MagLink LX 4 Devices Use of Hard-coded Cryptographic Key

The secret used for validating authentication tokens is hardcoded in device firmware for affected versions. An attacker who obtains the signing key can bypass authentication, gaining complete access to the system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Doverfuelingsolutions

Products

Progauge Maglink Lx Console

CVE-2026-41569

authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints

authentik is an open-source identity provider. Prior to version 2026.2.3, the WS-Federation provider validates the user-supplied wreply parameter using a raw string prefix check rather than proper URL parsing. An attacker who can craft a login link can supply a wreply value on a different origin that passes the check (e.g. https://portal.example.com.evil.tld/), causing the victim's browser to POST the signed WS-Federation login response to attacker-controlled infrastructure. This issue has been patched in version 2026.2.3.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Goauthentik

Products

Authentik

CVE-2026-9490

Acer Care Center creates a Named Pipe with a weak Security Descriptor

A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Acer

Products

Care Center

CVE-2025-11023

Local File Inclusion in ArkSigner's AcBakImzala

Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ArkSigner Software and Hardware Inc. AcBakImzala allows PHP Local File Inclusion. This issue affects AcBakImzala: before v5.1.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Arksigner

Products

Acbakimzala

CVE-2025-11025

Information Disclosure in Vimeosoft Information Technologies' Vimesoft Corporate Messaging Platform

Insertion of Sensitive Information Into Sent Data vulnerability in Vimesoft Information Technologies and Software Inc. Vimesoft Corporate Messaging Platform allows Retrieve Embedded Sensitive Data. This issue affects Vimesoft Corporate Messaging Platform: from V1.3.0 before V2.0.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Vimesoft

Products

Vimesoft