EUVD-2026-75401

There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access...

CVE-2026-52771

YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage interpolates a page tag retrieved from the database into a DELETE FROM …links WHERE totag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/tag A...

EUVD-2026-71447

Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V60005 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution...

CVE-2026-78599

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2026-78591

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

CVE-2026-84800

Craft CMS versions = 5.0.0-RC1 and 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by folder and filename after the permission checks execute, so...

CVE-2026-73758

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low privilege operator user to change the state of certain settings of a vulnerable system...

CVE-2026-73755

CVE-2026-73755 is a privilege escalation vulnerability in the API endpoint of AOS-CX (HPE). An authenticated low-privilege operator user , after a required user interaction, can access sensitive session information from the system. The CVSS 3.1 score is 5.7 (MEDIUM) with the vector AV:N/AC:L/PR:L...

CVE-2026-73755 Privilege Escalation via Unauthorized Access to Sensitive Session Information

A privilege escalation vulnerability exists in the API endpoint of AOS-CX. Successful exploitation could allow an authenticated low-privilege operator user, after a required user action, to access sensitive information from the vulnerable system...

CVE-2026-73747

A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user with local access to elevate their user privileges and make limited modifications on the affected system...

CVE-2026-73741

A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level...

CVE-2026-73735

Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access some information beyond their privilege level. Successful exploitation could allow an attacker to obtain limited information and/or make limited changes beyond what is...

CVE-2026-73704

A command sanitization bypass exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to escalate their permissions to those of an administrative user, leading to complete compromise of the affected system...

CVE-2026-73700

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit could allow an attacker to...

CVE-2026-73744 Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected...

CVE-2026-73744

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer . An authenticated low-privilege operator user can exploit it to disrupt the availability of the affected interface. The CVSS 3.1 base score is 3.5 (LOW) , with a network attack vector...

CVE-2026-73742 Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the...

CVE-2026-73741 Authenticated Limited File Read allows Data Exposure in HPE Networking Fabric Composer API

A vulnerability in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to view some system files. Successful exploitation could allow an attacker to access limited data beyond what is authorized by the user's existing privilege level...

CVE-2026-73733

CVE-2026-73733 affects the API in HPE Networking Fabric Composer . Authentication bypasses in the API allow an authenticated low-privilege operator user to circumvent existing authentication controls, retaining limited access to the system after that access should have been revoked. The CVSS 3.1 ...

EUVD-2026-69460

Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentication controls. Successful exploitation could allow an attacker to retain limited access to the affected system after that access should ha...