CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

WordPress Viable URL Media Uploader plugin <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Peerapat Samatathanyakorn in WordPress Plugin Viable URL Media Uploader versions = 1.0.1...

CVE-2026-76738

A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service...

CVE-2026-76735

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to netwo...

CVE-2026-100292

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

EUVD-2026-89405

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100296

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , a vulnerability exists in the web server's SOAP-RPC handler . An attacker with any authenticated user privileges can send an empty-body POST request to /setUserConfig to trigger a silent downgrade of the administrator password to its default va...

WordPress WP Directory Kit plugin <= 1.5.4 - Authenticated (Custom+) SQL Injection vulnerability

Authenticated Custom+ SQL Injection vulnerability discovered by zickzick2 in WordPress Plugin WP Directory Kit versions = 1.5.4...

EUVD-2026-89367

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

CVE-2026-100292 Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if...

CVE-2026-100292

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , an authenticated request can enable a hidden debug interface . This interface allows additional commands to be sent to a backend service, potentially exposing system-level functionality . If crafted inputs reach the underlying command handler, ...

CVE-2026-76738

A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On . This flaw allows an authenticated attacker with administrative privileges to cause a denial of service (DoS) by interrupting the normal operation of the affected service. While the service is impacted, it is...

CVE-2026-76737 Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On

An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of...

CVE-2026-76736 Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking Instant On

A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service...

CVE-2026-76736 Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking Instant On

A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service...

CVE-2026-76735 Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to netwo...

CVE-2026-76735

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On . An authenticated local attacker with high privileges could exploit this flaw to retrieve sensitive information, provided specific external preconditions are met. This data cou...

EUVD-2026-89354

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to netwo...