CVE-2026-84365

Hono (a JavaScript web framework) has an incomplete fix for CVE-2026-39408 in its toSSG() static site generation method, affecting versions from 4.12.12 and fixed in 4.13.5 . The path normalization routine used to verify output paths does not fully collapse runs of consecutive parent-directory se...

CVE-2026-84364

Hono is a JavaScript web application framework supporting any runtime. Prior to 4.13.5 , the parseBody() function, when dot-notation parsing is enabled, does not limit nesting depth or the number of intermediate objects created from dot-separated form field names. A single deeply dotted field nam...

CVE-2026-84363

Hono is a web application framework for any JavaScript runtime. Prior to 4.13.5 , its query helpers treat a question mark after a literal hash fragment as the start of a query string, allowing the application to read request parameters that browsers, reverse proxies, filtering rules, and other mi...

CVE-2026-63435

Mail (Ruby gem for email generation, parsing, and sending) is vulnerable to email address spoofing via malformed RFC 2047 encoded-words prior to version 2.9.1 . The root cause lies in Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode in lib/mail/utilities.rb, which used a single S...

CVE-2026-84361

Composer (PHP dependency manager) versions 1.0 through 2.2.30 and 2.10.3 are affected by a vulnerability in Composer\Util\Perforce . A malicious dependency package from a custom Composer repository or untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh:...

CVE-2026-84311

pypdf , a pure-Python PDF library, is vulnerable to a denial-of-service condition in versions prior to 6.16.1 . A crafted PDF can trigger exponential traversal in PageObject._extract_text and PageObject.extract_xform_text (in pypdf/_page.py) by invoking a directed acyclic graph of reused form XOb...

CVE-2017-0198

CVE-2017-0198 is a reserved candidate with no public technical details yet. A Telegram sighting was recorded but provides no further context. Monitor for future updates when the reserving organization publishes details.

CVE-2018-18574

CVE-2018-18574 is associated with CMSMadeSimple and relates to an Unrestricted Executable File Upload (UEFU) vulnerability, as indicated by its listing in the FUSE penetration testing tool's results (NDSS 2020 paper by WSP Lab, KAIST). FUSE is specifically designed to identify file upload bugs, a...

CVE-2018-18637

CVE-2018-18637 affects ECCube3 , a web application, with an Unrestricted Executable File Upload (UEFU) vulnerability. The bug was identified using FUSE , a penetration testing framework developed by WSP Lab at KAIST (published at NDSS 2020), which is specifically designed to discover file upload ...

CVE-2018-19172

CVE-2018-19172 is associated with the Elgg application, as documented by the FUSE penetration testing tool (WSP Lab, KAIST), which identifies Unrestricted Executable File Upload (UEFU) vulnerabilities in PHP web applications. The official CVE entry remains in a reserved/placeholder state, with no...

CVE-2018-19419

CVE-2018-19419 is an Unrestricted Executable File Upload (UEFU) vulnerability in CMSMadeSimple , as identified by the FUSE penetration testing tool (NDSS 2020, WSP Lab at KAIST). While the CVE entry itself remains reserved with no vendor-confirmed details, the FUSE project's published results exp...

CVE-2018-19062

CVE-2018-19062 affects CMSimple , a lightweight web content management system. The vulnerability is an Unrestricted Executable File Upload (UEFU) flaw, meaning an attacker can upload executable files without proper restriction. This CVE was identified through the FUSE penetration testing framewor...

CVE-2014-08361

CVE-2014-08361 is currently reserved with no public technical details. A recent sighting was observed on a Telegram channel, but no product, root cause, or impact information is available yet. Monitor for updates.

CVE-2022-01388

This CVE candidate has been reserved but no concrete technical details are publicly available in the provided documents. A Telegram sighting was recorded on 2026-09-01. Action: monitor for updates.

CVE-2014-2917

CVE-2014-2917 is a credentials disclosure vulnerability in MongoDB 's mongod affecting versions 2.6.x < 2.6.9 , 3.0.x < 3.0.14 , and 3.2.x

CVE-2015-2705

CVE-2015-2705 is a denial of service vulnerability in MongoDB (mongod) caused by a failure to check for missing values . An authenticated remote attacker with write access to a database can exploit this to crash the application. The vulnerability affects MongoDB 2.6.x prior to 2.6.9, 3.0.x prior ...

CVE-2023-24075

CVE-2023-24075 is currently in a reserved state with no public technical details. A sighting was noted from a Telegram channel, but no product, impact, or fix information is available. Action: monitor for updates.

CVE-2023-24073

The provided documents indicate this CVE is reserved with no public technical details available beyond a Telegram sighting. Action: monitor for updates when the candidate is publicized.

CVE-2023-24074

Technical details for CVE-2023-24074 remain unavailable; the entry is currently reserved. A sighting was reported on a Telegram channel, but no concrete product, root cause, or impact information has been published. Monitor for updates.

CVE-2026-84310

pypdf , a pure-Python PDF library, is vulnerable to denial-of-service via crafted PDFs. The vulnerable component is the _get_outline function in pypdf/_doc_common.py, which lacks global entry-count and nesting-depth limits during outline traversal. A malicious PDF with a large number of outline e...

CVE-2023-44970

CVE-2023-44970 remains reserved with no public technical details available. The only observed data consists of sightings on a Telegram channel. Action: monitor for updates.

CVE-2023-43837

This CVE entry is currently reserved with no public technical details available in the provided documents. Action: monitor for updates when the reserving organization publicizes the vulnerability.

CVE-2026-84309

pypdf versions prior to 6.16.0 are vulnerable to an infinite loop in TreeObject.insert_child (pypdf/generic/_data_structures.py). An attacker can craft a PDF with a cyclic tree structure that causes the method to follow /Next links indefinitely when a writing code path inserts a child, resulting ...

CVE-2026-76658

A vulnerability in the SSH daemon of HPE Networking Fabric Composer allows an unauthenticated remote attacker to gain administrative access to affected hosts. Successful exploitation enables arbitrary command execution as a privileged user on the underlying operating system, leading to complete s...

CVE-2026-76657

HPE Networking Fabric Composer is affected by an authentication bypass vulnerability in its API . An unauthenticated, remote attacker can circumvent existing authentication controls to gain administrative privileges , leading to complete compromise of the host. The CNA-assigned CVSS 3.1 score is ...

CVE-2026-73748

HPE Networking Fabric Composer is affected by an authenticated sensitive information disclosure vulnerability in its interface, where sensitive data is exposed in cleartext format . An attacker with administrative privileges can retrieve this information, which could be leveraged to gain further ...

CVE-2026-73747

CVE-2026-73747 is a local privilege-escalation vulnerability in HPE Networking Fabric Composer . An authenticated low-privilege operator user with local access can elevate privileges and make limited modifications on the affected system. The CVSS 3.1 score is 2.5 (LOW) , reflecting a local attack...

CVE-2026-73746

A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer , allowing an authenticated low-privilege operator user to interrupt normal operation of the affected service. The underlying root cause is not detailed in the provided documents. CVSS v3.1 score is 3.1 (LOW) wi...

CVE-2026-73744

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer . An authenticated low-privilege operator user can exploit it to disrupt the availability of the affected interface. The CVSS 3.1 base score is 3.5 (LOW) , with a network attack vector...

CVE-2026-73743

HPE Networking Fabric Composer has a vulnerability in its web-based management interface that allows an unauthenticated remote attacker to access data in a cleartext format . A successful exploit could expose network infrastructure data to further compromise. The CVSS 3.1 score is 3.7 (LOW) , ref...

CVE-2026-73742

HPE Networking Fabric Composer contains a vulnerability in an API endpoint classified as Improper Client Address Validation . An authenticated low-privilege operator user can spoof the source address attributed to their requests, causing inaccurate attribution information to be recorded on the af...

CVE-2026-73741

HPE Networking Fabric Composer contains a vulnerability in its API that allows an authenticated low-privilege operator user to read certain system files beyond their authorized privilege level. The resulting impact is a limited confidentiality breach , with no integrity or availability effects, r...

CVE-2026-73740

HPE Networking Fabric Composer is affected by a local privilege escalation vulnerability. An authenticated privileged user on the underlying host can elevate their privileges to a higher role, allowing them to change the state of certain system settings . The CVSS 3.1 score is 4.4 (Medium) , refl...

CVE-2026-73739

CVE-2026-73739 is an authenticated sensitive information disclosure in the API of HPE Networking Fabric Composer . Sensitive data that was expected to remain protected is exposed in cleartext format , allowing an attacker with administrative privileges and local access to retrieve it. The CVSS 3....

CVE-2026-73738

A vulnerability in the underlying operating system of HPE Networking Fabric Composer allows an authenticated low-privilege operator with local access to view sensitive information. The retrieved information could be leveraged to escalate privileges on the affected system. The HPE CNA rates this C...

CVE-2026-73737

An unauthenticated path traversal vulnerability affects the API endpoint of HPE Networking Fabric Composer . A successful exploit allows an adjacent, unauthenticated attacker with high complexity and user interaction to manipulate user-generated files, potentially causing unauthorized changes to ...

CVE-2026-73736

CVE-2026-73736 is an unauthenticated information disclosure vulnerability in the web-based management interface of HPE Networking Fabric Composer . A remote attacker with no prior authentication can view and read files within an affected directory, leading to potential data exposure. The CVSS v3....

CVE-2026-73735

CVE-2026-73735 is an access control vulnerability in the API of HPE Networking Fabric Composer that allows an authenticated low-privilege operator user to read or modify data beyond the scope of their assigned permissions. The impact is rated MEDIUM (CVSS 3.1: 5.4) with low confidentiality and in...

CVE-2026-73734

An unauthenticated open redirect vulnerability exists in the web-based management interface of HPE Networking Fabric Composer , allowing a remote attacker to redirect users to an arbitrary URL. The vulnerability requires user interaction but no prior authentication, carrying a CVSS 3.1 score of 5...

CVE-2026-73733

CVE-2026-73733 affects the API in HPE Networking Fabric Composer . Authentication bypasses in the API allow an authenticated low-privilege operator user to circumvent existing authentication controls, retaining limited access to the system after that access should have been revoked. The CVSS 3.1 ...

CVE-2026-73732

HPE Networking Fabric Composer contains a vulnerability in its underlying operating system that allows an authenticated, low-privilege operator with local access to obtain sensitive information. Successful exploitation could enable an attacker to retrieve data useful for gaining further unauthori...

CVE-2026-73731

A reflected cross-site scripting (XSS) vulnerability in the web-based management interface of HPE Networking Fabric Composer allows an unauthenticated remote attacker to execute arbitrary script code in a victim's browser. The attack requires user interaction (e.g., clicking a crafted link) and r...

CVE-2026-73730

A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer , caused by broken access control . An authenticated low-privilege operator user can change the state of certain system settings, resulting in high integrity impact without affecting confidentiality or availa...

CVE-2026-73729

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privilege operator user with local access to upstream AFC dependencies to view sensitive information. Successful exploitation could lead to access of data beyond the user's author...

CVE-2026-73728

CVE-2026-73728 affects the API of HPE Networking Fabric Composer . An authenticated low-privilege operator user can trigger denial-of-service vulnerabilities, interrupting the normal operation of the affected service. The vulnerability is network-exploitable with low attack complexity and require...

CVE-2026-73727

HPE Networking Fabric Composer contains an information disclosure vulnerability in its API that allows an authenticated low-privilege operator user to access sensitive data beyond their authorized privilege level. A successful exploit could be leveraged to gain further access to network services ...

CVE-2026-73726

CVE-2026-73726 affects the underlying operating system of HPE Networking Fabric Composer , allowing an unauthenticated adjacent actor to circumvent existing authentication controls. Successful exploitation grants an attacker administrative access , the ability to modify system configurations , an...

CVE-2026-73725

CVE-2026-73725 is a local privilege-escalation vulnerability in HPE Networking Fabric Composer that, when successfully exploited, allows a local attacker with low privileges to achieve arbitrary code execution with root , resulting in complete compromise of the affected host. The CVSS 3.1 base sc...

CVE-2026-73724

Privilege escalation vulnerabilities in the API of HPE Networking Fabric Composer stem from broken access control , allowing an authenticated low-privilege operator user to change the state of certain system settings. The CVSS 3.1 score is 7.1 (HIGH) with high integrity and low availability impac...

CVE-2026-73723

HPE Networking Fabric Composer contains a privilege escalation vulnerability in its web-based management interface . An authenticated user with low-privilege operator access can perform state-changing actions that exceed their authorized permission level. The flaw is network-reachable with low at...