CVE-2026-42922

CriticalCVSS 9.8/10Last modified Oct 29, 2026

Description

A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285

Affected software

Vendor	Product	Versions
frangoteam	Frangoteam	1.3.2-2809

References

https://talosintelligence.com/vulnerability_reports/TALOS-2026-2419

Timeline

Published: Oct 29, 2026
Last modified: Oct 29, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-429235.3NLnet Labs Unbound up to and including version 1.25.0 has a vulnerability in the DNSSEC validator where the code path to consult the negativ CVE-2026-429248.7An authenticated attacker with the Resource Administrator or Administrator role can create SNMP configuration objects through iControl SOAP CVE-2026-429265.8When NGINX Open Source is configured to proxy HTTP/2 traffic by setting proxy_http_version to 2, and also uses proxy_set_body, an attacker m CVE-2026-429298.3Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials.CVE-2026-42935.3The affected Kieback & Peter DDC building controllers are vulnerable to cross-site scripting, enabling JavaScript to be executed by the vict CVE-2026-429308.7When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restriction CVE-2026-429316.5Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint CVE-2026-429325.3Naxclow device identifiers use fixed manufacturing prefixes combined with sequential counters, producing a fully predictable and enumerable CVE-2026-4293310.0Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use a CVE-2026-429344.8NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_charset_module module. When charset, source_charset, and charset_map a CVE-2026-429368.4The installer of HYPER SBI 2 insecurely loads Dynamic Link Libraries. If there is a crafted DLL at the same directory when invoking the affe CVE-2026-429376.5Incorrect permission assignment vulnerabilities exist in BIG-IP and BIG-IQ TMOS Shell (tmsh) arp and ndp commands, and in BIG-IP iControl RE