CVE-2026-116755

Improper Neutralization of Special Elements used in a Command 'Command Injection' in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestratio...

CVE-2026-116755

The Orchestrator component of SoftIron HyperCloud (versions 1.0 through 2.6.17) is vulnerable to OS Command Injection due to improper neutralization of special elements. Specifically, attacker-controlled content in virtual machine templates, such as the VM DESCRIPTION field, is processed via a sh...

CVE-2026-116755 SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields

Improper Neutralization of Special Elements used in a Command 'Command Injection' in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestratio...

EUVD-2026-114571

Improper Neutralization of Special Elements used in a Command 'Command Injection' in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestratio...

CVE-2026-116755: SoftIron HyperCloud: Improper Neutralization of Special Elements used in a Command ('Command Injection') in the Orchestrator component of…

Improper Neutralization of Special Elements used in a Command 'Command Injection' in the Orchestrator component of SoftIron HyperCloud allows an authenticated user with access to the management plane to execute arbitrary operating system commands on hypervisor hosts as the privileged orchestratio...

PT-2026-134408

Name of the Vulnerable Software and Affected Versions SoftIron HyperCloud versions 1.0 through 2.6.17 Description Command Injection in the Orchestrator component allows an authenticated user with management plane access to execute arbitrary operating system commands on hypervisor hosts as the...

CVE-2026-1842

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

CVE-2026-1842

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

CVE-2026-1842 HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized Access

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

CVE-2026-1842

CVE-2026-1842 affects HyperCloud 2.3.5–2.6.8. Root cause: refresh tokens can be used directly for resource access and do not invalidate previously issued access tokens when a refresh token is used, allowing long-lived or concurrent access. Refresh tokens have a default lifetime of about one year,...

CVE-2026-1842: Insufficient Session Expiration

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

SoftIron HyperCloud security vulnerabilities

SoftIron HyperCloud is an intelligent cloud architecture developed by SoftIron Corporation. Versions of SoftIron HyperCloud 2.6.8 and earlier contain security vulnerabilities. These vulnerabilities stem from the ability to directly use refresh tokens for resource access, without ensuring that...

PT-2026-21250

HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a refresh token was used. Because refresh tokens have a significantly longer lifetime default one year, an authenticated...

CVE-2023-45085

An issue exists in SoftIron HyperCloud where compute nodes may come online immediately without following the correct initialization process. In this instance, workloads may be scheduled on these nodes and deploy to a failed or erroneous state, which impacts the availability of these workloads tha...

CVE-2023-45084

An issue exists in SoftIron HyperCloud where drive caddy removal and reinsertion without a reboot may erroneously cause the system to recognize the caddy as new media and wipe all data on the drives due to a missing synchronization flaw, which impacts data availability and integrity. This issue...

EUVD-2024-51312

Malicious code in bioql PyPI...

EUVD-2023-49406

Malicious code in bioql PyPI...

EUVD-2023-49404

Malicious code in bioql PyPI...

EUVD-2023-49405

Malicious code in bioql PyPI...

CVE-2025-10650

SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Affects non-production debug and internal development builds created between versions 2.5.0 a...