What’s Vulnerable › Products

frangoteam FUXA vulnerabilities

33 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 27 published in the last 12 months.

Check whether your frangoteam FUXA version is affected

Latest frangoteam FUXA vulnerabilities

• CVE-2026-67442 — FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup (CVSS 2.0)
• CVE-2026-67443 — FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution) (CVSS 9.2)
• CVE-2026-67440 — FUXA: Unauthenticated Socket.IO read events (CVSS 6.9)
• CVE-2026-65985 — FUXA: SSRF hardening for `device-webapi-request` (CVSS 6.0)
• CVE-2026-65984 — FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions (CVSS 7.5)
• CVE-2026-47721 — FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions (CVSS 6.3)
• CVE-2026-47720 — FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString (CVSS 5.3)
• CVE-2026-47719 — FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading (CVSS 8.2)
• CVE-2026-47718 — FUXA provides guest and invalid-token access to protected read APIs in secure mode (CVSS 5.5)
• CVE-2026-47717 — FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations (CVSS 7.5)
• CVE-2026-72586 — frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler (CVSS 7.5)
• CVE-2026-43947 — FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass (CVSS 8.9)
• CVE-2026-43946 — FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue (CVSS 7.7)
• CVE-2026-43945 — FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection (CVSS 8.9)
• CVE-2025-69985 — (CVSS 9.8)
• CVE-2026-25951 — FUXA has a Path Traversal Sanitization Bypass (CVSS 7.2)
• CVE-2026-25939 — FUXA Unauthenticated Remote Arbitrary Scheduler Write (CVSS 9.1)
• CVE-2026-25938 — FUXA Unauthenticated Remote Code Execution in Node-RED Integration (CVSS 9.8)
• CVE-2026-25895 — FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API (CVSS 9.8)
• CVE-2026-25894 — FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration (CVSS 9.8)
• CVE-2026-25893 — FUXA Unauthenticated Remote Code Execution via Admin JWT Minting (CVSS 9.8)
• CVE-2026-25752 — FUXA Unauthenticated Remote Arbitrary Device Tag Write (CVSS 9.1)
• CVE-2026-25751 — FUXA Unauthenticated Exposure of Plaintext Database Credentials (CVSS 7.5)
• CVE-2025-69983 — (CVSS 9.8)
• CVE-2025-69981 — (CVSS 9.8)