CVE-2026-73751

CVE-2026-73751 is an authenticated remote command injection in the AOS-CX (Aruba) web-based management interface, assigned by HPE . An authenticated user with low-privileged access can submit crafted input through the web interface to execute arbitrary commands on the underlying operating system,...

CVE-2026-73724

Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...

CVE-2026-73741

HPE Networking Fabric Composer contains a vulnerability in its API that allows an authenticated low-privilege operator user to read certain system files beyond their authorized privilege level. The resulting impact is a limited confidentiality breach , with no integrity or availability effects, r...

EUVD-2026-69462

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is...

EUVD-2026-69454

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A successful exploit allows an attacker to access data beyond what is authorized by the user's existing privilege level, which could be used to...

CVE-2026-73721 Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the...

CVE-2026-73714

CVE-2026-73714 is an authenticated sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer . An authenticated low-privilege operator user can access data beyond what their existing privilege level authorizes, potentially leading to further unauthorized access. ...

Security Bulletin: IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE [CVE-2026-18887]

Summary IBM i is vulnerable to allowing sensitive information access to unauthorized users CVE-2206-18887 in Portable Application Solutions Environment PASE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18887 DESCRIPTION: IBM i could allow an authenticate...

CVE-2021-40870

CVE-2021-40870 Aviatrix allows an authenticated user to execute arbitrary code...

CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

EUVD-2026-69575

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

EUVD-2026-69557

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...

libssh: libssh: denial of service via oversized SFTP read length

A flaw was found in libssh. A remote authenticated client can issue SSHFXPREAD requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests...

CVE-2020-14295

CVE-2020-14295 CVE-2020-14295 proof of concept. The original post can be found at exploit-db. Install requirements root@kitploit: python3 -m pip install -r requirements.txt Usage root@kitploit: $ python3 cactisqlirce.py --help usage: cactisqlirce.py -h -t -u -p --lhost --lport Cacti 1.2.12 - SQL...

CVE-2016-5734-docker

CVE-2016-5734-docker PhpMyAdmin 4.0.x—4.6.2 Remote Code Execution Vulnerability CVE-2016-5734 Setup root@kitploit: git clone https://github.com/miko550/CVE-2016-5734-docker.git cd CVE-2016-5734-docker docker compose up hhtp://localhost:8083 exploit root@kitploit: python3 cve-2016-5734.py -u root...

cve-2025-11142-axis-mediaclip-rce

CVE-2025-11142 — AXIS mediaclip.cgi OS Command Injection n-day research writeup & PoC — post-patch technical analysis of a CVSS 7.1 OS command injection vulnerability in the AXIS VAPIX Media Clip API, independently rediscovered and verified through black-box testing against an Axis device. Axis's...

CVE-2026-84207

Heym before 0.0.98 is affected by a Server-Side Request Forgery (SSRF) vulnerability in its WebSocket Send and WebSocket Trigger workflow nodes. The root cause is the failure to apply SSRF egress guards to these nodes, allowing authenticated users to craft workflow nodes with arbitrary URLs and h...

EUVD-2026-69295

Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect to internal services. Attackers can craft workflow nodes with arbitrary URLs and headers to reach internal services and read responses from the WebSocket...

CVE-2026-84205 GROWI through 8.0.2 Authorization Bypass Through User-Controlled Key on apiv3 Revision Retrieval

GROWI contains an access control vulnerability in the GET /api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier th...