https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T10:11:19.967298+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2021-40050 cnvd-2021-40050 2026-10-04T10:11:19.970936+00:00 cnvd-2021-40050 https://cve.radiocsirt.org/vuln/euvd-2026-178858 EUVD-2026-178858 2026-10-04T10:11:19.970968+00:00 EUVD-2026-178858 https://cve.radiocsirt.org/vuln/fkie_cve-2021-27657 fkie_cve-2021-27657 2026-10-04T10:11:19.970983+00:00

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

 https://cve.radiocsirt.org/vuln/ghsa-g3gv-gq3r-m3m6 GHSA-g3gv-gq3r-m3m6 2026-10-04T10:11:19.971012+00:00

Successful exploitation of this vulnerability could give an authenticated Metasys user an unintended level of access to the server file system, allowing them to access or modify system files by sending specifically crafted web messages to the Metasys system. This issue affects: Johnson Controls Metasys version 11.0 and prior versions.

 https://cve.radiocsirt.org/vuln/gsd-2021-27657 gsd-2021-27657 2026-10-04T10:11:19.971028+00:00 gsd-2021-27657 https://cve.radiocsirt.org/vuln/icsa-21-159-01 ICSA-21-159-01 — Johnson Controls Metasys 2026-10-04T10:11:19.971039+00:00

Metasys servers, engines, and tools do not properly assign, modify, track, or check privileges for an actor, thus creating an unintended sphere of control for said actor. CVE-2021-27657 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).