Grid Protection Alliance has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 6. The median CVSS is 8.2 (high), with 2 rated critical. None have a confirmed exploitation report. Most affected products: openPDC (5), openPDC (Docker image) (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.2
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Products
- openPDC 5
- openPDC (Docker image) 1
Worst active — by depth score
CVE-2026-105278Critical· 9.8The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use54CVE-2026-100730Critical· 9.8A service console interface on openPDC and openHistorian deserializes a client-supplied data structure54CVE-2026-104629High· 8.8A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load48CVE-2026-105281High· 7.5The internal data publisher on openPDC accepts network connections without authentication in its default configuration41CVE-2026-85479Medium· 5.3The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration29
Grid Protection Alliance vulnerabilities
CVEs affecting Grid Protection Alliance, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-105278Critical· 9.8The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use
The published Docker image for openPDC includes a fixed administrative credential with no forced change on first use. An attacker with network access to the management interface can authenticate using this credential and gain full admini…
CVE-2026-85479Medium· 5.3The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration
The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.
CVE-2026-105281High· 7.5The internal data publisher on openPDC accepts network connections without authentication in its default configuration
The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement to…
CVE-2026-104629High· 8.8A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host f…
CVE-2026-101022Medium· 4.3A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network desti…
CVE-2026-100730Critical· 9.8A service console interface on openPDC and openHistorian deserializes a client-supplied data structure
A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows…