CVE-2026-73703 Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated adjacent attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script co...

CVE-2026-73700 Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to conduct a stored cross-site scripting XSS attack against an administrative user of the interface. A successful exploit could allow an attacker to...

PT-2026-84421

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A command injection flaw in the web-based management interface allows an unauthenticated remote attacker to execute arbitrary commands on the underlying host operating...

PT-2026-84469

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low-privileged access can execute arbitrary commands on the underlying operating system by submitting crafted input through the...

PT-2026-84447

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to gain insight into some data handled by the affected interface. A successful exploit could allow an attacker to gain access to some data in a cleartext format...

PT-2026-84448

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected...

PT-2026-84497

Name of the Vulnerable Software and Affected Versions AOS-CX switches affected versions not specified Description The web-based management interface lacks Cross-Site Request Forgery CSRF protection for certain sessions. This allows a remote unauthenticated attacker to execute arbitrary input...

PT-2026-84422

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A flaw in the web-based management interface allows an unauthenticated remote attacker to access sensitive information. This occurs if an authenticated user is persuade...

CVE-2026-73751: Improper Neutralization of Special Elements used in a Command

An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system...

PT-2026-84438

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL...

PT-2026-84435

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script...

PT-2026-84427

Name of the Vulnerable Software and Affected Versions HPE Networking Fabric Composer affected versions not specified Description A privilege escalation issue exists in the web-based management interface. This flaw allows an authenticated user with low-privilege operator permissions to perform...

PT-2026-84478

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description An authenticated Path Traversal vulnerability exists in the web-based management interface. Path Traversal is a flaw that allows an attacker to access files and directories that are stored...

PT-2026-84440

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some system files. Successful exploitation could allow an attacker to read files within the affected directory...

PT-2026-84475

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description A flaw in the web-based management interface allows an authenticated remote attacker to perform a server-side request forgery SSRF attack. SSRF is a technique where an attacker induces a...

EUVD-2026-67784

PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parsequerystring to process...

EUVD-2026-67713

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...

CVE-2026-81578 PaperCut MF/NG: Authentication Bypass

An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests targeting administrative functions can trigger backend actions prior to the completion of access validation checks. This allow...

CVE-2026-81578

An improper access control vulnerability (CWE-306) in the web management interface of PaperCut MF and PaperCut NG allows unauthenticated remote attackers to trigger administrative backend actions before access validation completes, enabling modification of system configurations. The root cause in...

EUVD-2026-67277

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability...