Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-22110 | 8.7 high | — | delta electronics, delta ufc500 | The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting. | 5 h ago |
| CVE-2026-22105 | 8.7 high | — | delta electronics, delta ufc500 | Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change sensitive settings such as the OCPP backend. | 5 h ago |
| CVE-2026-22109 | 8.4 high | — | delta electronics, delta ufc500 | The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical across devices and were unchanged on the tested unit. | 5 h ago |
| CVE-2026-22114 | 5.3 medium | — | delta electronics, delta ufc500 | HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible. | 5 h ago |
4 of 4
Download these 4 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.