Frangoteam
29 CVEs tracked since 2023. Since Sep 2023, none of them reached CISA KEV.
Frangoteam CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2023-09 | 5 | 0 |
| 2023-10 | null or fewer | |
| 2023-11 | null or fewer | |
| 2023-12 | null or fewer | |
| 2024-01 | null or fewer | |
| 2024-02 | null or fewer | |
| 2024-03 | null or fewer | |
| 2024-04 | null or fewer | |
| 2024-05 | null or fewer | |
| 2024-06 | null or fewer | |
| 2024-07 | null or fewer | |
| 2024-08 | null or fewer | |
| 2024-09 | null or fewer | |
| 2024-10 | null or fewer | |
| 2024-11 | null or fewer | |
| 2024-12 | null or fewer | |
| 2025-01 | null or fewer | |
| 2025-02 | null or fewer | |
| 2025-03 | null or fewer | |
| 2025-04 | null or fewer | |
| 2025-05 | null or fewer | |
| 2025-06 | null or fewer | |
| 2025-07 | null or fewer | |
| 2025-08 | null or fewer | |
| 2025-09 | null or fewer | |
| 2025-10 | null or fewer | |
| 2025-11 | null or fewer | |
| 2025-12 | null or fewer | |
| 2026-01 | null or fewer | |
| 2026-02 | 13 | 0 |
| 2026-03 | null or fewer | |
| 2026-04 | null or fewer | |
| 2026-05 | null or fewer | |
| 2026-06 | null or fewer | |
| 2026-07 | null or fewer | |
| 2026-08 | 11 | 0 |
Products
The products that kept showing up in Frangoteam's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting Frangoteam.
- CVE-2026-67442FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup2.0
- CVE-2026-65984FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions—
- CVE-2026-67443FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)—
- CVE-2026-65985FUXA: SSRF hardening for `device-webapi-request`—
- CVE-2026-67440FUXA: Unauthenticated Socket.IO read events—
- CVE-2026-47721FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions6.3
- CVE-2026-47719FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading8.2
- CVE-2026-47720FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString5.3
- CVE-2026-47718FUXA provides guest and invalid-token access to protected read APIs in secure mode—
- CVE-2026-47717FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations7.5
- CVE-2026-72586frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler7.5
- CVE-2026-43947FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass—
- CVE-2026-43946FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue—
- CVE-2026-43945FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection—
- CVE-2026-13207Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing7.5
The record
- Peak rank
- #73 in Feb 2026
- Busiest month shown
- Feb 2026, 13 CVEs
- Months with a KEV entry
- 0 since Sep 2023
- Monthly snapshots
- 3 since 2023