CVE-2026-77555

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77544

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-77558

A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-37603

Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder pH7 Social Dating CMS through 19.2.0. The CAPTCHA escalation flag is stored in the PHP session as captchaadminenabled and the CAPTCHA form element is only built when that flag is presen...

CVE-2026-37604

pH7Software pH7Builder pH7 Social Dating CMS through 18.2.0 resolves the client IP address in protected/framework/Ip/Ip.class.php from the HTTPCLIENTIP and HTTPXFORWARDEDFOR headers without verifying the request comes from a trusted proxy. Because the admin login attempt counter and lockout are...

EUVD-2026-84677

A vulnerability exists in the Analytics and Location Engine ALE API that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input to a specific API endpoint. Successful exploitation could result...

EUVD-2026-84676

Multiple vulnerabilities exist in the Analytics and Location Engine ALE that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful...

CVE-2026-76716 Unauthenticated Remote Unauthorized Access and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

Multiple vulnerabilities exist in the Analytics and Location Engine ALE that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful...

EUVD-2026-84672

A vulnerability exists in the Analytics and Location Engine ALE that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications...

CVE-2026-76712 Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine ALE that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications...

CVE-2026-76712 Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine ALE that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications...

EUVD-2026-84673

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full syste...

EUVD-2026-84671

A vulnerability exists in an Analytics and Location Engine ALE component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful...

EUVD-2026-84670

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

EUVD-2026-84668

A vulnerability exists in the Analytics and Location Engine ALE where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in usi...

EUVD-2026-84669

A vulnerability exists in the internal administrative component of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting i...

EUVD-2026-84804

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-91129 Home Assistant: mDNS Server-Side Request Forgery

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...

CVE-2026-93981

A flaw was found in hono/jsx. This vulnerability occurs because the software fails to properly escape plain strings when they are rendered in certain contexts during server-side rendering. A remote attacker can exploit this by providing specially crafted input, leading to Cross-Site Scripting XSS...