CVE-2026-76714: Improper Neutralization of Special Elements used in an OS Command

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system...

CVE-2026-76713: Improper Privilege Management

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full syste...

CVE-2026-76710: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the Analytics and Location Engine ALE management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful...

CVE-2026-76711: Improper Input Validation

A vulnerability exists in an Analytics and Location Engine ALE component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful...

CVE-2026-76712: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the Analytics and Location Engine ALE that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications...

CVE-2026-76709: Improper Access Control

A vulnerability exists in the internal administrative component of Analytics and Location Engine ALE. Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting i...

CVE-2026-76708: Use of Hard-coded Credentials

A vulnerability exists in the Analytics and Location Engine ALE where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in usi...

Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model

This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the...

CVE-2026-9231: Improper Control of Filename for Include/Require Statement in PHP Program

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.8.0 via the wtegettemplate function. This makes it possible for authenticated attackers, with contributor-level access and above, ...

PT-2026-96993

Name of the Vulnerable Software and Affected Versions HPE Analytics and Location Engine versions 5.0.0.0 and earlier Description A flaw in the internal administrative component allows an unauthenticated remote attacker to obtain unauthorized write access to the file system with elevated privilege...

PT-2026-96999

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description An administrative component is susceptible to a man-in-the-middle MitM attack, which is a technique where an attacker intercepts and potentially alters communication...

PT-2026-96998

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description The web interface contains a flaw that allows remote authenticated users to execute arbitrary commands on the underlying host. A successful exploit could enable an...

PT-2026-96994

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE affected versions not specified Description The management interface contains a flaw that allows an unauthenticated remote attacker to disclose sensitive information. By sending specially crafted requests to...

PT-2026-96995

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description An issue exists in the Analytics and Location Engine ALE component where the process improperly handles incoming socket connections. An unauthenticated remote attacker c...

PT-2026-97000

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description Multiple issues exist that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these by sending specially crafted...

PT-2026-96996

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE affected versions not specified Description An issue in the Analytics and Location Engine ALE allows an unauthenticated remote attacker to gain unauthorized access, disclose sensitive information, or cause a...

PT-2026-96764

A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the file cms/weasel.php of the component Template Engine. The manipulation of the argument $ CMS'site' results in code injection. The attack may be performed fr...

PT-2026-96992

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine affected versions not specified Description The Analytics and Location Engine ALE and its underlying operating system utilize default, hard-coded credentials for multiple system and administrative accounts. An...

PT-2026-96684

Name of the Vulnerable Software and Affected Versions WP Travel Engine – Tour Booking Plugin – Tour Operator Software versions prior to 6.8.1 Description The plugin contains a Local File Inclusion flaw, which occurs when an application includes a file without properly validating the input, allowi...

PT-2026-97001

Name of the Vulnerable Software and Affected Versions Analytics and Location Engine ALE API affected versions not specified Description An unauthenticated remote attacker can cause the disclosure of sensitive information by providing specially crafted input to a specific API endpoint. This issue...