CVE-2026-23663

Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability

Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Global Secure Access

CVE-2025-41670

Untrusted Search Path

A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locations that are not sufficiently protected against modification by low-privileged users. As the service runs with elevated privileges, successful exploitation may result in a local privilege escalation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Phoenix Contact

Products

Axc F 1152 Axc F 1252 Axc F 2000 Ea and 11 more

CVE-2026-40822

Authenticated SQLi in DevSerialReset function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40827

Authenticated SQLi in _RemoveRequest function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _RemoveRequest function due to improper neutralization of special elements in a SQL DELETE command allowing for reading the whole database and deleting entries in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40844

Authenticated SQLi in dashboard view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dashboard view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-42740

WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through <= 1.0.3.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Tainacan Wordpress

Products

Tainacan Wordpress

CVE-2026-42901

Microsoft Entra ID Elevation of Privilege Vulnerability

Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Entra Id Microsoft Entra Id

CVE-2025-41669

Insufficient Verification of Data Authenticity

The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Phoenix Contact

Products

Axc F 1152 Axc F 1252 Axc F 2000 Ea and 11 more

CVE-2026-40810

Unauthenticated SQLi in userinfo Endpoint

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the userinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40811

Unauthenticated SQLi in ssoabstractservice

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the ssoabstractservice due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40812

Unauthenticated SQLi in getLiveValues function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getLiveValues functions sn parameter due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40814

Unauthenticated SQLi in _mb24confi_getTagAlarm function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dataapi.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40815

Unauthenticated SQLi in _mb24api_getUserAccount function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24api_getUserAccount function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40816

Unauthenticated SQLi in _mb24confi_getTagAlarm function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the mb24alarm.php files _mb24confi_getTagAlarm function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40817

Unauthenticated SQLi in getAlarmProfiles function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAlarmProfiles function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40818

Unauthenticated SQLi in _mb24confi_getDevice function function

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the _mb24confi_getDevice function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40821

Authenticated SQLi in getAccountByID function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getAccountByID function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line Mbconnectline

Products

Myrex24.virtual Myrex24 V2 Myrex24v2 and 6 more

CVE-2026-40823

Authenticated SQLi in DevSerialReset function

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the DevSerialReset function due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40825

Authenticated SQLi in accountstatus view

A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the accountstatus view devices parameter due to improper neutralization of special elements in a SQL UPDATE command allowing for reading the whole database and changing values in a non critical table. This can result in a total loss of confidentiality and some loss of integrity.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more

CVE-2026-40846

Authenticated SQLi in system view

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the system view due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Helmholz Mb Connect Line

Products

Myrex24v2 Myrex24v2.virtual Myrex24v2virtual and 2 more