CVE-2026-87680

A command injection vulnerability exists in the REST API management interface of Brocade Fabric OS versions prior to 10.0.1 . This flaw allows an authenticated user to execute arbitrary system commands by providing crafted input parameters . The vulnerability is addressed in FOS 10.0.1 .

CVE-2026-87679

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploi...

EUVD-2026-94653

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploi...

CVE-2026-87679

Brocade Fabric OS versions before 10.0.1 are vulnerable to a heap-based buffer overflow (CWE-122) during trunk configuration operations. The application fails to enforce boundary checks when parsing user-supplied list strings into dynamically allocated heap arrays. An authenticated administrator ...

CVE-2026-87679

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploi...

PT-2026-107906

Inefficient algorithmic complexity in the webmail's message view of the REST API in Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote unauthenticated attacker to make the webmail, the administration console and the REST API unavailable by sending a message. The route that renders ...

PT-2026-107825

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query parameters...

PT-2026-107769

Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads such as device configuration attributes or port mapping requests the REST API service fails to properly validate...

PT-2026-107725

A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters...

PT-2026-108188

Name of the Vulnerable Software and Affected Versions TVU Networks Receiver/Transceiver devices versions prior to 7.9 Description Remote unauthenticated attackers can read sensitive device information and modify device configuration due to missing authentication on REST API endpoints on port 8288...

CVE-2026-87670: Authentication Bypass by Spoofing

An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers ...

PT-2026-107782

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data across...

PT-2026-107800

An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary file...

PT-2026-107804

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An OS command injection issue exists in the time and zone management subsystem. The system fails to sanitize input values when updating...

PT-2026-107724

When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploi...

PT-2026-107783

An authorization logic vulnerability exists in the Brocade Fabric OS versions before 10.0.1 REST API gateway. The internal gate guarding restricted management endpoints relies exclusively on client-controlled HTTP headers. An authenticated user with any valid REST session can spoof these headers ...

CVE-2026-87669: Missing Authorization

A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite MAPS violation data across...

PT-2026-107818

Name of the Vulnerable Software and Affected Versions Brocade Fabric OS versions prior to 9.2.2d Brocade Fabric OS versions 10.0.0 through 10.0.0a1 Description An OS command injection flaw exists in the REST API management interface. An authenticated remote attacker with high privileges can execu...

CVE-2026-76278

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the editspl2modulepermissions capability could use the affected Representational State Transfer REST API to access permission grants for SPL2 modules that the user does not have permission to view. The...

CVE-2026-76271

In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could cause a denial of service against a Representational State Transfer REST API endpoint in the Discover Splunk Observability Cloud app. The vulnerabili...