CVE-2026-28325

SolarWinds Observability Self-Hosted is impacted by an unauthenticated remote code execution vulnerability. This flaw originates from the deserialization of untrusted data when the application is configured to use a specific communication mode. The vulnerability allows for high impact on confiden...

CVE-2026-76717

A vulnerability exists in the HPE Networking Analytics and Location Engine (ALE) API , allowing an unauthenticated remote attacker to disclose sensitive information. By providing specially crafted input to a specific API endpoint, an attacker can obtain sensitive user data, including password has...

CVE-2026-76716

The HPE Networking Analytics and Location Engine (ALE) is affected by multiple vulnerabilities that may allow an unauthenticated remote attacker to gain unauthorized access or cause a denial of service . Exploitation is possible by sending specially crafted input or leveraging improper security c...

CVE-2026-76715

A vulnerability in an administrative component of the HPE Networking Analytics and Location Engine (ALE) allows an unauthenticated remote attacker to perform a man-in-the-middle (MitM) attack. Successful exploitation can lead to remote code execution with root privileges on the affected appliance...

CVE-2026-76714

The HPE Networking Analytics and Location Engine (ALE) contains a vulnerability in its web interface that allows remote authenticated users to perform Remote Code Execution (RCE) . By exploiting this flaw, an attacker can execute arbitrary commands on the underlying host with root privileges , po...

CVE-2026-76713

A vulnerability exists in the maintenance restore functionality of HPE Networking Analytics and Location Engine (ALE) . An authenticated remote attacker can exploit this flaw to gain unauthorized access to the file system with root privileges , potentially leading to a full system compromise . No...

CVE-2026-76712

A vulnerability exists in the HPE Networking Analytics and Location Engine (ALE) that may allow an unauthenticated remote attacker to gain unauthorized access , cause information disclosure , or trigger a denial of service . The vulnerability can be exploited by sending specially crafted input or...

CVE-2026-76711

A vulnerability exists in the Analytics and Location Engine (ALE) component of HPE Networking products. The impacted process improperly handles incoming socket connections , allowing an unauthenticated remote attacker to provide specially crafted input during the connection process. Successful ex...

CVE-2026-76710

A vulnerability in the HPE Networking Analytics and Location Engine (ALE) management interface allows an unauthenticated remote attacker to disclose sensitive information. By sending specially crafted requests to specific internal endpoints, an attacker can gain access to site hierarchy , infrast...

CVE-2026-76709

A vulnerability exists in the internal administrative component of the HPE Networking Analytics and Location Engine (ALE) . This flaw allows an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges . Successful exploitation could lead to a f...

CVE-2026-76708

A vulnerability exists in the HPE Networking Analytics and Location Engine (ALE) because the application and its underlying operating system utilize default, hard-coded credentials for multiple administrative and system accounts. An unauthenticated remote attacker can exploit this by logging in w...

CVE-2026-59991

The psd-tools Python package, used for processing Adobe Photoshop PSD files, contains an uncontrolled memory allocation vulnerability in the PSDImage.composite() and PSDImage.numpy() functions. Prior to version 1.17.4 , the software allocated output buffers based on attacker-controlled header geo...

CVE-2026-28324

The SolarWinds Observability Self-Hosted platform is vulnerable to an unauthenticated remote code execution (RCE) vulnerability. The root cause is identified as insufficient integrity checks affecting installations configured in non-default and non-secure configurations . This vulnerability has a...

CVE-2026-63628

The mppx TypeScript interface for the machine payments protocol is vulnerable to a gas draining attack in versions prior to 0.8.2 . The flaw exists in the fee-payer cosigning path located in src/tempo/internal/fee-payer.ts, where the software copies a client-supplied access_list from a 0x78 FeePa...

CVE-2026-63627

The mppx TypeScript interface for machine payments protocol contains a vulnerability prior to version 0.8.2 in the FeePayerPolicy component (src/tempo/internal/fee-payer.ts). The decodeFunctionData function failed to reject trailing bytes when validating fee-sponsored calldata. This allowed a cli...

CVE-2026-91129

The Home Assistant home automation software is vulnerable to a Server-Side Request Forgery (SSRF) flaw in the IPP integration (specifically within homeassistant/components/ipp/config_flow.py). Prior to version 2026.2.3 , the async_step_zeroconf function automatically processed unauthenticated _ip...

CVE-2026-91130

Prior to version 2026.7.0 , the Statistics Graph card in Home Assistant (specifically in src/components/chart/statistics-chart.ts) was vulnerable to Cross-Site Scripting (XSS) . The application failed to escape entity names passed through getStatisticLabel and computeStateName, as well as interpo...

CVE-2026-57149

plone.app.portlets.portlets provides a Plone-specific user interface for plone.portlets, as well as a standard set of portlets that ship with Plone. Starting in version 5.0.0 and prior to versions 5.0.8, 6.0.4, and 7.0.2, the Classic portlet plone.app.portlets.portlets.classic used its...

CVE-2026-63386

The js-toml JavaScript TOML parser is vulnerable to a denial of service (DoS) due to uncontrolled recursion in the load() function. In versions prior to 1.1.3 , the recursive parser at src/load/parser.ts and the interpreter at src/load/interpreter.ts fail to bound the nesting depth of arrays, inl...

CVE-2026-77399

The icalendar library for Python, versions 6.1.0 through 7.2.2 , is vulnerable to a Denial of Service (DoS) . The vInt.from_ical function accepts an attacker-controlled VALARM REPEAT value, allowing applications to eagerly expand it without an application-level limit. While parsing alone does not...