CVE-2026-42952

HighCVSS 7.5/10Last modified Oct 25, 2026

Description

Previously, there was no throttling on repeated authentication attempts to the charging station backend, which could allow an attacker to execute a denial-of-service attack.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-307

Affected software

No affected versions have been published.

Timeline

Published: Jul 10, 2026
Last modified: Oct 25, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-429538.4The application contains an out-of-bounds write vulnerability that can be exploited by an attacker to cause the program to write data past t CVE-2026-429553.7In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family o CVE-2026-429587.8The application contains a use-after-free vulnerability that can be exploited to cause memory corruption while parsing specially crafted fil CVE-2026-429597.5NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a crash CVE-2026-42968.8An incorrect regular expression vulnerability was identified in GitHub Enterprise Server that allowed an attacker to bypass OAuth redirect U CVE-2026-4296010.0NLnet Labs Unbound up to and including version 1.25.0 is vulnerable to poisoning via promiscuous records for the authority section. Promiscu CVE-2026-429615.1ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens. If a user views a CVE-2026-429656.5A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed CVE-2026-429685.5Out-of-bounds read in Windows Telephony Service allows an authorized attacker to disclose information locally.CVE-2026-429695.5Use of uninitialized resource in Windows Push Notifications allows an authorized attacker to disclose information locally.CVE-2026-42978.8The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. T CVE-2026-429705.5Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose informati