Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-59886exploit | 8.8 high | 0.00% | eaton, xcomfort_ethernet_communication_interface | Improper input validation at one of the endpoints of Eaton xComfort ECI's web interface, could lead into an attacker with network access to the device executing privileged user commands. As cybersecurity standards continue to evolve and to meet our requirements today, Eaton has decided to discontinue the product. Upon retirement or end of support, there will be no new security updates, non-security updates, or paid assisted support options, or online technical content updates. | 19 Oct |
| CVE-2026-22622 | 8.8 high | 1.0% | no CPE yet | Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device. | Fri 23 Oct |
| CVE-2026-22620 | 8.6 high | 1.0% | no CPE yet | Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device. | Fri 23 Oct |
| CVE-2026-22621 | 8.3 high | 1.0% | no CPE yet | Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment. | Fri 23 Oct |
| CVE-2026-22619 | 9.9 critical | 0.00% | eaton, intelligent_power_protector | Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execution by an attacker with access to the software package. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download center. | Mon 26 Oct |
| CVE-2025-59889 | 8.6 high | 0.00% | no CPE yet | Improper authentication of library files in the Eaton IPP software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of IPP which is available on the Eaton download center. | 8 Oct |
| CVE-2025-48396 | 8.3 high | 0.00% | no CPE yet | Arbitrary code execution is possible due to improper validation of the file upload functionality in Eaton BLSS. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004). | 18 Oct |
| CVE-2026-41021 | 7.5 high | 0.00% | no CPE yet | Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials. | Tue 27 Oct |
| CVE-2026-41020 | 7.5 high | 0.00% | no CPE yet | Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device. | Tue 27 Oct |
| CVE-2026-22616 | 7.5 high | 0.00% | eaton, intelligent_power_protector | Eaton Intelligent Power Protector (IPP) software allows repeated authentication attempts against the web interface login page due to insufficient rate‑limiting controls. This security issue has been fixed in the latest version of Eaton IPP which is available on the Eaton download centre. | Mon 26 Oct |
| CVE-2026-22617 | 7.4 high | 0.00% | eaton, intelligent_power_protector | Eaton Intelligent Power Protector (IPP) uses an insecure cookie configuration, which could allow a network‑based attacker to intercept the cookie and exploit it through a man‑in‑the‑middle attack. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre. | Mon 26 Oct |
| CVE-2025-59890 | 7.3 high | 0.00% | no CPE yet | Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with local access to execute unauthorized code or commands. This security issue has been fixed in the latest version of Galileo which is available on the Eaton download center. | 18 Oct |
| CVE-2026-22615 | 7.2 high | 0.00% | eaton, intelligent_power_protector | Due to improper input validation in one of the Eaton Intelligent Power Protector (IPP) XML, it is possible for an attacker with admin privileges and access to the local system to inject malicious code resulting in arbitrary command execution. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre. | Mon 26 Oct |
| CVE-2026-22618 | 7.1 high | 0.00% | eaton, intelligent_power_protector | A security misconfiguration was identified in Eaton Intelligent Power Protector (IPP), where an HTTP response header was set with an insecure attribute, potentially exposing users to web‑based attacks. This security issue has been fixed in the latest version of Eaton IPP software which is available on the Eaton download centre. | Mon 26 Oct |
| CVE-2025-48397 | 7.1 high | 0.00% | no CPE yet | The privileged user could log in without sufficient credentials after enabling an application protocol. This security issue has been fixed in the latest script patch latest version of of Eaton BLSS (7.3.0.SCP004). | 18 Oct |
| CVE-2026-41022 | 5.9 medium | 0.00% | no CPE yet | Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4. | Tue 27 Oct |
16 of 16
Download these 16 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.