CVE-2026-78225

CriticalCVSS 9.0/10Last modified Sep 24, 2026

Description

A hardcoded cryptographic server key vulnerability exists in the deployer-ng Update Controller component of Wärtsilä FOS-Onboard.

Metrics

CVSS 3.1 9.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-321

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 24, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-782276.5NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--witCVE-2026-782285.9Uncontrolled Recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final atCVE-2026-782296.7Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affectCVE-2026-78239.8A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cCVE-2026-782306.0AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that buildsCVE-2026-782315.3When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OCVE-2026-782349.9A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespaceCVE-2026-782368.8An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over CrossCVE-2026-782377.8Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistentCVE-2026-782384.8SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is logginCVE-2026-782399.8Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable adCVE-2026-78245.9An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the applicati
CVE-2026-78225: Critical severity, CVSS 9.0 | Vulnix