CVE-2026-76721

A buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON APs . This flaw allows an unauthenticated remote attacker to execute arbitrary code on the underlying host. If successfully exploited, the attacker could gain the ability to run code as a privileged user...

EUVD-2026-89340

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-76721 Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-84436

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges...

CVE-2026-84436 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged authenticated CLI user to execute arbitrary commands with root privileges...

CVE-2026-84436

IBM Guardium Data Protection 12.2 is vulnerable to OS command injection within the certificate export CLI functionality . A privileged authenticated CLI user can exploit this vulnerability to execute arbitrary commands with root privileges . This issue is caused by the improper neutralization of ...

CVE-2026-97901

A flaw was found in the Linux kernel's Generic Netlink genetlink component. This flaw allows a local user to cause a Denial of Service DoS through a system crash. The vulnerability occurs because the kernel fails to maintain a reference to the target module during a policy dump that spans multipl...

CVE-2026-90907

Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...

CVE-2026-90907 Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...

CVE-2026-90907 Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...

EUVD-2026-89085

Joomla! Core - 20260902 - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration...

Malicious code in @hrmony/benefit-mobilitaet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf87d41e53e59a65644aaf92de291a5943afa017fbdc2068ebb6741383f60688 On module load, index.js unconditionally contacts the EC2 Instance Metadata Service at 169.254.169.254, obtains an IMDSv2 token, and retrieves instan...

CVE-2026-100287

Missing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to permanently delete or restore vault attachments via a crafted API request...

Improper Certificate Validation

org.apache.sshd, sshd-core is vulnerable to improper certificate validation. The vulnerability is due to the server-side authentication process not validating force-command and verify-required certificate options, which allows an attacker with a specially crafted OpenSSH user certificate to...

Server-Side Request Forgery

Apache Shiro is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of the form‑resubmit target in the Jakarta EE integration module, where the server will initiate an outbound connection to a URL supplied in a crafted HTTP request and transmit...

CVE-2026-8937 Missing Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to read private child issue contents, including titles and descriptions, from projects...

CVE-2026-8937

GitLab CE/EE versions 19.0 before 19.2.7 , 19.3 before 19.3.3 , and 19.4 before 19.4.1 are affected by a Missing Authorization vulnerability. Under specific conditions, an authenticated user could read private child issue contents, such as titles and descriptions, from projects they are not autho...

CVE-2026-10518 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 17.9 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user with guest-level permissions to read private security policy content they were not authoriz...

CVE-2026-102474

A heap out-of-bounds write vulnerability exists in dash within the conv_escape function. The printf builtin incorrectly reserves only four bytes for converting Unicode \u or \U escapes , even though multi-byte tokens may require five or six bytes. A local user can trigger this by supplying such e...

BIT-GITLAB-2026-92628 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under a race condition, the MCP search tool's shared state handling could have caused search results to be returned under an incorrect user context...