CVE-2026-76678 Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on th...

EUVD-2026-79204

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on th...

CVE-2026-76678

HPE Networking EdgeConnect SD-WAN Gateways are affected by an authenticated command injection vulnerability in the API endpoint . A low-privilege, authenticated remote attacker can exploit this to escalate privileges and execute arbitrary system commands with root privileges on the underlying ope...

CVE-2026-76678 Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges on th...

CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

PT-2026-92461

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description A flaw in the API endpoint allows an unauthenticated remote attacker to access sensitive information. This data retrieval could potentially be used to...

PT-2026-92465

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

PT-2026-92443

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description Buffer overflow issues exist in an API endpoint that could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operatin...

PT-2026-92466

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description An issue in the API endpoint allows an unauthenticated remote attacker to obtain sensitive information. This could lead to the disclosure of...

CVE-2026-76706: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, whic...

CVE-2026-76701: Missing Authentication for Critical Function

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to netwo...

CVE-2026-76691: Buffer Copy without Checking Size of Input

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-76705: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-76687: Improper Privilege Management

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges o...

PT-2026-92438

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description A flaw in the API endpoint allows a low-privilege authenticated remote attacker to escalate privileges. This could lead to the execution of arbitrary system...

PT-2026-92447

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description A flaw in the API endpoint allows a low-privilege authenticated remote attacker to escalate privileges. This could lead to the execution of arbitrary...

PT-2026-92451

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description Buffer overflow vulnerabilities exist in the API endpoint of the system. A buffer overflow occurs when a program writes more data to a block of memory, or...

PT-2026-92096

Name of the Vulnerable Software and Affected Versions Vikunja versions prior to 2.6.0 Description The software exposes the raw Time-based One-Time Password TOTP shared secret after enrollment. This occurs through the 'GET /api/v1/user/settings/totp' and 'GET /api/v1/user/settings/totp/qrcode'...

CVE-2026-90942

Casdoor through 4.4.0 fails to properly mask the instance-wide built-in certificate private key in /api/get-certs and /api/get-cert endpoints, allowing organization administrators to retrieve it. Attackers can use the exposed private key to forge JWT tokens for any user in any organization,...

PT-2026-94017

Name of the Vulnerable Software and Affected Versions Cisco ISE versions 3.1 patches 8 through 11 Cisco ISE versions 3.2 patches 7 through 10 Cisco ISE versions 3.3 patches 1 through 11 Cisco ISE versions 3.4 base 3.4.0 through patch 6 Cisco ISE versions 3.5 base 3.5.0 through patch 3 Cisco ISE-P...