CVE-2026-73718

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful...

CVE-2021-31717

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:25+00:00| seen| https://t.me/hackingAttack/22454 2026-09-02 01:02:57+00:00| seen| https://t.me/hackingAttack/22454 2026-09-07 17:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/22454 2026-09-08 00:00:38+00:00|...

EUVD-2026-69445

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful...

CVE-2026-73718 Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful...

CVE-2026-73718

A vulnerability in the web-based management interface of HPE Networking Fabric Composer allows an unauthenticated remote attacker to access sensitive information by convincing an authenticated user to interact with a specially crafted URL . The disclosed impact is confidentiality loss (no integri...

CVE-2026-73718 Unauthenticated Information Disclosure in Web Interface allows Sensitive Data Exposure in HPE Networking Fabric Composer

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if the attacker can convince an authenticated user of the interface to interact with a specially crafted URL. Successful...

ROS-20260901-73-0013

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

ROS-20260901-73-0015

The vulnerability of the PHP-FPM process manager, a PHP programming language interpreter, exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code XSS using a specially created URL address...

CVE-2026-55566

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extension process. An attacker can execute arbitrary JavaScript code in a user's browser by enticing a user to visit a specially crafted URL. Details Cross-site scripting or XSS is a code vulnerability...

CVE-2026-55566

Yamcs , a mission control framework, is affected by a DOM XSS in the /ext URL route (affected versions prior to 5.12.8 and 5.13.2 ). The root cause is that attacker-controlled data in files extension.matcher.ts, extension.component.ts, and app.component.ts is rendered via innerHTML without valida...

CVE-2026-78615

A Reflected Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: mailman (UTSA-2026-093193)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093193 advisory. In GNU Mailman before 2.1.36, a crafted URL to the Cgi/options.py user options page can execute arbitrary JavaScript for XSS. Tenable has extracted the preceding...

PT-2026-82046

Name of the Vulnerable Software and Affected Versions TeamViewer Full Client and Host for Linux versions prior to 15.81.5 Description A command injection issue exists that allows a remote attacker to execute arbitrary commands with the privileges of the current user. This occurs when a user click...

Johnson Controls Metasys 12.x / 13.x / 14.x < 14.1.5 / 15.x < 15.0.1 Cross-Site Scripting (CVE-2026-34491)

A low-privilege user can inject a malicious XSS payload into the Johnson Controls Metasys UI via a crafted URL. The payload persists across logins and executes in the browser context of other users, including administrators. Successful exploitation of this vulnerability could allow a low-privileg...

EUVD-2026-63134

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "scadmin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator URL. T...

CVE-2026-76327 SPL Injection through Splunk Web in Splunk Secure Gateway

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.9, 3.9.23, and 3.8.70, an unauthenticated user could trick a user who holds the "admin" or "scadmin" Splunk roles into opening a crafted Splunk Web Uniform Resource Locator URL. T...

BIT-GITLAB-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

PT-2026-73299

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...

EUVD-2026-60351

A blind SSRF attack in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code via the server retrieving an image from a crafted URL, and it fails to return the content or any errors directly...