CVE-2026-76729 Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote...

EUVD-2026-89348

A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote...

CVE-2026-76729

A format string vulnerability exists in the API endpoint of HPE Networking Instant ON APs . An authenticated remote attacker with high privileges can provide modified input to cause memory corruption . This could lead to a denial-of-service (DoS) condition or remote code execution (RCE) within th...

CVE-2026-76728 Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-76728

A vulnerability exists in the API endpoint of HPE Networking Instant ON APs , where an authenticated remote attacker with high privileges can perform a server-side request forgery (SSRF) attack. Successful exploitation may enable the attacker to execute arbitrary commands as a privileged user on ...

EUVD-2026-89347

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-76728 Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-76726 Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain...

CVE-2026-76726

An authentication bypass vulnerability exists in the API endpoint of HPE Networking Instant ON . An unauthenticated remote attacker could bypass network access controls, provided certain preconditions outside of the attacker's control are met. Successful exploitation may result in unauthorized ac...

CVE-2026-76726 Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain...

EUVD-2026-89345

An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain...

CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-102811

Marmite versions through 0.4.2 are vulnerable to unauthenticated API access via its development server endpoints: /__marmite__/content, /__marmite__/config, and /__marmite__/file/. Due to missing authentication, attackers can create, modify, or overwrite site content and configurations. Furthermo...

CVE-2026-102811 Marmite through 0.4.2 Unauthenticated API Access via Development Server

Marmite through 0.4.2 contains missing authentication in the development server endpoints /marmite/content, /marmite/config, and /marmite/file/, allowing unauthenticated attackers to create, modify, and overwrite site content and configuration. Attackers can exploit unsanitized path parameters in...

CVE-2026-100244 CentralAuth exposes locally suppressed block information via globaluserinfo API and Special:CentralAuth (incomplete fix for CVE-2025-62669)

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from before 1.46.1, 1.45.5, 1.43.10...

Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

MAL-2026-17250 Malicious code in @hrmony/api-gateway-service-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a48388c29a59698997efcb654da3c9182138846dad274f82ad2a1101843c5e4 index.js runs a top-level await fetch... on import that harvests installer host secrets and posts them to the hardcoded attacker endpoint...

Exploit for SQL Injection in Wordpress

WP2Shell — Unauthenticated SQL Injection Proof of Concept C...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

CVE-2026-100289

Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to generate a network scan token and perform internal network discovery and port scanning through the gateway via a crafted API request...