7277 matches found
CVE-2026-73701: Improper Control of Generation of Code
An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticate...
CVE-2026-19766: Improper Authentication
An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete...
CVE-2026-73716: Improper Neutralization of Special Elements used in an OS Command
A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful...
PT-2026-84424
Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description Insecure file operations within the API allow an authenticated remote attacker to achieve remote code execution. This flaw enables the execution of arbitrary commands a...
PT-2026-84405
An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could be exploited if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an unauthenticate...
PT-2026-84487
Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An authenticated arbitrary file write issue allows an authenticated actor to create or modify files and execute arbitrary commands as a privileged user on the underlying operating system. This...
CVE-2026-73766: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...
CVE-2026-58301
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...
CVE-2026-58301: Server-Side Request Forgery (SSRF)
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0...
Linux Distros Unpatched Vulnerability : CVE-2026-58301
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connectio...
CVE-2026-82634
Frappe Framework development builds contain an authorization flaw in the render_jinja_template endpoint (file: print_format_generator.py). Low-privileged users with print permission on any document can supply raw Jinja template strings, enabling arbitrary SELECT statements against unrelated table...
CVE-2026-82236 File Browser 2.63.6 through 2.63.23 Share Link Exposure via File Deletion
File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared file. Attackers can access the surviving share link to retrieve new unrelated content uploaded to the same path without authentication...
CVE-2026-81668 Rubygem-katello: cross-tenant content view filter rule access and modification via unauthorized parent filter lookup
A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Conte...
CVE-2026-81625 Stack buffer overflow in Greenbone OS and openvas-scanner
A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test VT on the affected products to trigger a stack buffer overflow and gain full access on the compromised system...
CVE-2026-81625
CVE-2026-81625 is a stack buffer overflow in Greenbone OS and openvas-scanner . A remote attacker with user privileges can execute a malicious or compromised NASL vulnerability test (VT) to trigger the overflow, potentially gaining full access to the system. The vulnerability is rated HIGH with a...
EUVD-2026-66771
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...
EUVD-2026-66765
A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account...
CVE-2026-81529: Improper Neutralization of Argument Delimiters in a Command
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
CVE-2026-16809 LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
LimeSurvey Community Edition 7.0.5 contains a stored cross-site scripting vulnerability in the survey quota creation workflow. An authenticated low-privileged user who can create and manage their own survey can store malicious JavaScript in a quota message. This issue affects LimeSurvey: 7.0.5...