CVE-2026-71981

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

CVE-2026-73783 Authenticated Stack Overflow Vulnerabilities lead to Denial-of-Service in AOS-CX

Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated malicious actor to cause a denial-of-service condition on the affected system...

CVE-2026-73776 Authenticated Signature Verification Bypass Leading to Arbitrary Code Execution in AOS-CX

A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authenticated malicious actor with administrative privileges to execute arbitrary code on the underlying operating system, when certain pre-conditions outside of th...

CVE-2026-73775 Authenticated Sensitive Information Disclosure Vulnerabilities in AOS-CX

Vulnerabilities in the API endpoint of AOS-CX could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access to network services supported by...

CVE-2026-73766 Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX

Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...

CVE-2026-73760

An authenticated Path Traversal vulnerability in HPE AOS-CX allows an attacker with low privileges to read arbitrary files from the web-based management interface of the underlying operating system, potentially leading to remote unauthorized access to files. The CVSS 3.1 score is 6.5 (Medium) wit...

CVE-2026-73753

CVE-2026-73753 is an authenticated remote command injection vulnerability in the HPE ArubaOS-CX (AOS-CX) Command Line Interface . Through affected command-line operations, an authenticated low-privileged user can execute arbitrary commands with privileged user permissions on the underlying operat...

CVE-2026-73751

CVE-2026-73751 is an authenticated remote command injection in the AOS-CX (Aruba) web-based management interface, assigned by HPE . An authenticated user with low-privileged access can submit crafted input through the web interface to execute arbitrary commands on the underlying operating system,...

CVE-2026-73724

Privilege escalation vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...

CVE-2026-73741

HPE Networking Fabric Composer contains a vulnerability in its API that allows an authenticated low-privilege operator user to read certain system files beyond their authorized privilege level. The resulting impact is a limited confidentiality breach , with no integrity or availability effects, r...

EUVD-2026-69462

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is...

EUVD-2026-69454

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive information. A successful exploit allows an attacker to access data beyond what is authorized by the user's existing privilege level, which could be used to...

CVE-2026-73721 Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the...

CVE-2026-73714

CVE-2026-73714 is an authenticated sensitive information disclosure vulnerability in the API of HPE Networking Fabric Composer . An authenticated low-privilege operator user can access data beyond what their existing privilege level authorizes, potentially leading to further unauthorized access. ...

Security Bulletin: IBM i is Affected By Sensitive Information Exposure Vulnerability in PASE [CVE-2026-18887]

Summary IBM i is vulnerable to allowing sensitive information access to unauthorized users CVE-2206-18887 in Portable Application Solutions Environment PASE as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-18887 DESCRIPTION: IBM i could allow an authenticate...

CVE-2021-40870

CVE-2021-40870 Aviatrix позволяет аутентифицированному пользователю выполнять произвольный код...

CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

EUVD-2026-69575

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

CVE-2026-63138 Improper Neutralization of Special Elements in Data Query Logic in Kibana Leading to Information Disclosure

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

EUVD-2026-69557

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level permissions could submit a specially crafted request that causes excessive resource consumption, which may render Kibana...