CVE-2026-76863 Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the modqosbandwidth plan.json handling within filterconnsdumpcgi.c and IGDCgiCall.c. Authenticated users with broad roles can access these QoS read routes to obtain live network telemetry beyond their...

CVE-2026-76863

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling, specifically within filter_conns_dump_cgi.c and IGD_CgiCall.c. Authenticated users with broad roles can access QoS read routes to obtain live network telemetry...

CVE-2026-92234

QloApps versions through 1.7.0 contain a reflected cross-site scripting (XSS) vulnerability in the Hotel Reservation System feature management page (back-office). The child_features parameter is reflected unescaped into validation error messages, allowing an authenticated back-office user who fol...

CVE-2026-76705

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-76704

A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access...

CVE-2026-76702

A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause a denial-of-service. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state...

CVE-2026-76690

A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected component. Successful exploitation could...

CVE-2026-76691

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-76687

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow a low-privilege authenticated remote attacker to escalate privileges. Successful exploitation of this vulnerability may enable the attacker to execute arbitrary system commands with root privileges o...

CVE-2026-76675

A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system leading to complete system compromise...

CVE-2026-76670

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise...

CVE-2026-76672

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint...

CVE-2026-32599

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...

CVE-2026-18423

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference IDOR in the Express saved search preset delete and edit dialogs . An authenticated user holding only view permission on a single Express entity could therefore permanently delete, with no undo, or rename saved sear...

EUVD-2026-79940

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

CVE-2026-83088

CVE-2026-83088 affects the RDBMS component of Oracle Database Server , versions 23.4.0 through 23.26.3 . An authenticated low-privileged attacker with network access via Oracle Net can trigger a complete denial of service , causing a hang or frequently repeatable crash of RDBMS. Although the vuln...

CVE-2026-18425

Concrete CMS 9 (versions 9.0.0 through 9.5.2) contains an IDOR flaw in the dashboard sitemap reorder action (SitemapUpdate::updateDisplayOrder). The controller checks only the global access_sitemap task permission and omits any per-page edit permission check, allowing an authenticated user with s...

CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

CVE-2026-32599 Netmaker has a boolean‑based SQL Injection

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection...

CVE-2026-32599

Netmaker (a WireGuard network manager) is vulnerable to boolean-based SQL injection in its SQLite database layer. Prior to version 1.5.0 , the sqliteDeleteRecord function builds SQL DELETE statements via direct string concatenation of user-supplied input from the DELETE /api/dns/{network}/{domain...