# cve.now: Frangoteam

The newest entries naming Frangoteam as an affected vendor (up to 200), of 26 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-42949](https://cve.now/CVE-2026-42949.md): A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). (CVSS 5.6)
- [CVE-2026-40063](https://cve.now/CVE-2026-40063.md): A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). (CVSS 5.3)
- [CVE-2026-42922](https://cve.now/CVE-2026-42922.md): A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). (CVSS 9.8)
- [CVE-2026-67442](https://cve.now/CVE-2026-67442.md): FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup (CVSS 2.0)
- [CVE-2026-65984](https://cve.now/CVE-2026-65984.md): FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions (CVSS 7.5)
- [CVE-2026-67443](https://cve.now/CVE-2026-67443.md): FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution) (CVSS 9.2)
- [CVE-2026-65985](https://cve.now/CVE-2026-65985.md): FUXA: SSRF hardening for \`device-webapi-request\` (CVSS 6.0)
- [CVE-2026-67440](https://cve.now/CVE-2026-67440.md): FUXA: Unauthenticated Socket.IO read events (CVSS 6.9)
- [CVE-2026-47721](https://cve.now/CVE-2026-47721.md): FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions (CVSS 6.3)
- [CVE-2026-47719](https://cve.now/CVE-2026-47719.md): FUXA: Unauthenticated SSRF via Socket.IO DEVICE\_WEBAPI\_REQUEST and DEVICE\_PROPERTY with response reading (CVSS 8.2)
- [CVE-2026-47720](https://cve.now/CVE-2026-47720.md): FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString (CVSS 5.3)
- [CVE-2026-47718](https://cve.now/CVE-2026-47718.md): FUXA provides guest and invalid-token access to protected read APIs in secure mode (CVSS 5.5)
- [CVE-2026-47717](https://cve.now/CVE-2026-47717.md): FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations (CVSS 7.5)
- [CVE-2026-72586](https://cve.now/CVE-2026-72586.md): frangoteam FUXA - Missing Authentication on DAQ\_QUERY Socket.IO Event Handler (CVSS 7.5)
- [CVE-2026-43947](https://cve.now/CVE-2026-43947.md): FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass (CVSS 8.9)
- [CVE-2026-43946](https://cve.now/CVE-2026-43946.md): FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue (CVSS 7.7)
- [CVE-2026-43945](https://cve.now/CVE-2026-43945.md): FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection (CVSS 8.9)
- [CVE-2026-13207](https://cve.now/CVE-2026-13207.md): Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing (CVSS 8.7)
- [CVE-2026-25895](https://cve.now/CVE-2026-25895.md): FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API (CVSS 9.5)
- [CVE-2026-25894](https://cve.now/CVE-2026-25894.md): FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration (CVSS 9.5)
- [CVE-2026-25893](https://cve.now/CVE-2026-25893.md): FUXA Unauthenticated Remote Code Execution via Admin JWT Minting (CVSS 10.0)
- [CVE-2026-25951](https://cve.now/CVE-2026-25951.md): FUXA has a Path Traversal Sanitization Bypass (CVSS 8.6)
- [CVE-2026-25939](https://cve.now/CVE-2026-25939.md): FUXA Unauthenticated Remote Arbitrary Scheduler Write (CVSS 9.3)
- [CVE-2026-25938](https://cve.now/CVE-2026-25938.md): FUXA Unauthenticated Remote Code Execution in Node-RED Integration (CVSS 9.5)
- [CVE-2026-25751](https://cve.now/CVE-2026-25751.md): FUXA Unauthenticated Exposure of Plaintext Database Credentials (CVSS 9.1)
- [CVE-2026-25752](https://cve.now/CVE-2026-25752.md): FUXA Unauthenticated Remote Arbitrary Device Tag Write (CVSS 9.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/frangoteam
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.