Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-11832exploit | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12275 | 10.0 critical | 1.0% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Mail Configuration File Manipulation + Command Execution.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-11925 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Incorrect Content-Type header in one of the APIs (`text/html` instead of `application/json`) replies may potentially allow injection of HTML/JavaScript into reply.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12001 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Lack of application manifest sanitation could lead to potential stored XSS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12104 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12176 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Undocumented administrative accounts were getting created to facilitate access for applications running on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12216 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Malicious / Malformed App can be Installed but not Uninstalled/may lead to unavailability.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12218 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Weak Default Credentials.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12219 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Vulnerable Components in Azure Access OS.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12220 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12285 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12363 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Email Password Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12364 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Weak Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12422 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Vulnerable Upgrade Feature (Arbitrary File Write) may lead to obtaining super user permissions on board.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12423 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Protocol manipulation might lead to denial of service.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2025-12424 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Privilege Escalation through SUID-bit Binary.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2025-12425 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Local Privilege Escalation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2025-12476 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Resource Lacking AuthN.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2025-12477 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Server Version Disclosure.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2025-12478 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2025-12479 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2025-12553 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12599 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12600 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Web UI Malfunction when setting unexpected locale via API.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12601 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Denial of Service Due to SlowLoris.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12515 | 10.0 critical | 0.00% | azure-access, blu-ic4_firmware, blu-ic2_firmware | Systemic Internal Server Errors - HTTP 500 ResponseThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2025-12516 | 10.0 critical | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Lack of Graceful Error Handling - HTTP 5xx ErrorThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
| CVE-2026-42602 | 8.1 high | 0.00% | opentelemetry, opentelemetry_collector_contrib | azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azure_auth. The extension's Authenticate method does not validate incoming bearer tokens as JWTs. Instead, it calls its own configured credential to obtain an access token and compares the client's token to the result with string equality — and the scope for that server-side token request is taken from the client-supplied Host header. As a result, a token minted for any Azure resource the service principal has ever been issued a token for (ARM, Graph, Key Vault, Storage, etc.) will authenticate to the collector if the attacker picks a matching Host. Tokens are replayable for the full issued lifetime (commonly several hours for managed identity tokens). | Mon 26 Oct |
| CVE-2026-88967 | 7.7 high | 0.00% | no CPE yet | A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery). | Wed 28 Oct |
| CVE-2025-12217 | 6.9 medium | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | SNMP Default Community String (public).This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12278 | 6.9 medium | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Logout Functionality not Working.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12284 | 6.9 medium | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Lack of Input Validation in the web UI might lead to potential exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12365 | 6.9 medium | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Error Messages Wrapped In HTTP Header.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12552 | 6.9 medium | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12554 | 6.9 medium | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12031 | 5.3 medium | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | HTTP Security Misconfiguration - Lacking Secure and HTTPOnly Attribute may allow reading the sensitive cookies from the javascript contextThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12114 | 5.2 medium | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Enabled serial console could potentially leak information that might help attacker to find vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12602 | 2.3 low | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | /etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12603 | 2.3 low | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | /etc/timezone can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12221 | 2.1 low | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5. | 18 Oct |
| CVE-2025-12517 | 2.1 low | 0.00% | azure-access, blu-ic2_firmware, blu-ic4_firmware | Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . | 18 Oct |
41 of 41
Download these 41 as CSV · subscribe to this list.
EPSS scores: 2026-10-29. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.