CVE-2026-44383High· 7.5▾ TwilightMultiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
0.4% → 0.6%
Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-54547Medium· 5.3On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operations after a configured session timeout expired
CVE-2026-3583Low· 3.1Improper Token Revocation via OAuth2 Scope Enforcement in Multiple WSO2 Products [Disrupted Authentication Flows]
CVE-2026-6647High· 7.4Incomplete OAuth Token Revocation via Case Mismatch in WSO2 Identity Server Allows Continued Access After Lifecycle Events
CVE-2026-9705Medium· 6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access token
GHSA-q929-g23j-2rc7Medium· 6.5Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token
CVE-2026-118665HighGraphQL Tools: Per-request connection parameters persist into later users' WebSocket authentications