These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-67442 is a low-severity vulnerability in FUXA, a web-based Process Visualization software. The issue allows for residual privilege and inconsistent access-control state due to improper role deletion. Affected users may retain authorization rights even after an administrator attempts to revoke them. This can lead to misleading audit results.
AI-assisted PatchSiren debrief based on the supplied source corpus. CVE-2026-67443 is a critical vulnerability in FUXA 1.3.2 and earlier versions. The vulnerability exists in the allowDashboard authorization gate in server/integrations/node-red/index.js, where the decoded identity is not inspected when nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure. This oversight allows remo [truncated]
CVE-2026-67440 is a medium-severity vulnerability in FUXA, a web-based Process Visualization software. In versions 1.3.2 and earlier, certain Socket.IO events can be invoked by remote unauthenticated or guest users to collect system-discovery information. This issue is fixed in version 1.3.3. The vulnerability allows unauthorized system-discovery information collection, potentially impacting defenders who [truncated]
CVE-2026-65985 is a vulnerability in FUXA, a web-based Process Visualization software. An authenticated non-admin runtime user can control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. This allows the attacker to use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints.
An attacker possessing a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion in FUXA versions 1.3.2 and earlier. This issue allows for continued unauthorized access and configuration changes. The vulnerability is fixed in version 1.3.3, and defenders should prioritize verifying and updating FUXA ins [truncated]
An authenticated non-admin operator can create or alter device actions and delete schedules in FUXA, a web-based Process Visualization software, gaining access to device-value changes and server-side project script execution normally reserved for administrators. This issue requires verification of access controls and prompt remediation to prevent unauthorized changes. The vulnerability exists in versions [truncated]
A vulnerability in FUXA's TDengine DAQ storage connector allows remote unauthenticated attackers to inject SQL queries, potentially exposing historical PLC tag values, device identifiers, and device names. This issue is fixed in version 1.3.2. The vulnerability exists due to improper escaping of backslashes in the escapeTdString function, which can be exploited through GET /api/daq or the Socket.IO DAQ_QU [truncated]
FUXA, a web-based Process Visualization software, has a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 1.3.2. This vulnerability allows a remote unauthenticated attacker to make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO [truncated]
CVE-2026-47718 is a vulnerability in FUXA, a web-based Process Visualization software. When `secureEnabled=true`, FUXA `1.3.0-2773` allows unauthorized access to project, alarms, and scheduler APIs. The issue is fixed in version 1.3.1. Defenders and administrators of FUXA deployments, especially those with `secureEnabled=true`, should assess exposure and prioritize verification and remediation. This vulne [truncated]
CVE-2026-47717 is a high-severity vulnerability in FUXA, a web-based Process Visualization software. In version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. This issue was fixed in version 1.3.1. The vulnerability allows unauthorized access to sensitive project configuration data, potentially impacting confi [truncated]
CVE-2026-43946 is a high-severity vulnerability in FUXA, a web-based Process Visualization software. Version 1.3.0 has an authorization bypass issue in the /api/getTagValue endpoint, allowing unauthenticated access to tag values when a referenced script does not exist. The issue was patched in version 1.3.1. This vulnerability has significant implications for organizations using FUXA, as it could allow at [truncated]