EUVD-2026-69615

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

CVE-2026-73751 Authenticated Remote Command Injection in AOS-CX Web-based Management Interface

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

Exploit for Argument Injection in Gnu Inetutils

CVE-2026-24061 — GNU Inetutils Telnetd Authentication Bypass...

GHSA-WWV5-G3V4-889X Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

Summary The CVE-2026-35536 fix added a validation loop that rejects \x00-\x20\x3b\x7f, but only for the hardcoded lowercase keys name/domain/path/samesite. The still-live deprecated kwargs path writes attacker-supplied attribute values straight into the Morsel with no validation, and because...

CVE-2026-73721

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated remote attacker to conduct SQL injection attacks against the HPE Networking Fabric Composer instance. An attacker could exploit these vulnerabilities to obtain and modify sensitive information in the...

CVE-2026-73722

Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perform command injection against the affected system. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-73717

A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful...

AZL-98451 CVE-2026-72649 affecting package rubygem-elasticsearch 8.9.0-1

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-72649

Deserialization of Untrusted Data CWE-502 in the Elasticsearch machine learning component can lead to remote code execution via Object Injection CAPEC-586. A specially crafted trained model artifact could cause attacker-controlled logic to execute with a materially broader system-call surface tha...

CVE-2026-63138

Improper Neutralization of Special Elements in Data Query Logic CWE-943 in Kibana can lead to information disclosure via NoSQL Injection CAPEC-676. An authenticated user with access to the affected query functionality could submit specially crafted input that alters the intended query logic,...

CVE-2026-84361

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 clien...

CVE-2021-21337

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:40+00:00| seen| https://t.me/hackingAttack/11108 2026-09-02 01:03:17+00:00| seen| https://t.me/hackingAttack/11108 2026-09-08 05:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/11108 2026-09-09 00:00:41+00:00|...

CVE-2018-18964

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:12+00:00| seen| https://t.me/hackingAttack/29057 2026-09-01 20:02:15+00:00| seen| https://t.me/hackingAttack/27123 2026-09-01 20:02:17+00:00| seen| https://t.me/hackingAttack/27117 2026-09-01 20:02:17+00:00| seen|...

dracut: dracut: Root code execution via DHCP options command injection

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP Dynamic Host Configuration Protocol options, such as a malicious hostname, to a system using dracut's legacy DHCP path. These options are improperly handled and...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

A flaw was found in dracut. The die error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOTPATH option, an attacker on the adjacent network who controls...

CVE-2026-73731

A reflected cross-site scripting (XSS) vulnerability in the web-based management interface of HPE Networking Fabric Composer allows an unauthenticated remote attacker to execute arbitrary script code in a victim's browser. The attack requires user interaction (e.g., clicking a crafted link) and r...

CVE-2026-73722

CVE-2026-73722 affects the web-based management interface of HPE Networking Fabric Composer . Command injection vulnerabilities allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system, leading to full compromise of confidentiali...

EUVD-2026-69449

Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perform command injection against the affected system. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-73722 Authenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interface

Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perform command injection against the affected system. Successful exploitation could allow an attacker to execute arbitrary commands as a...