Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
42028
Total
3422
Critical
12413
High
12340
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-73752 | HIGH | 8.8 | An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files … | Sep 01, 2026 |
| CVE-2026-73751 | HIGH | 8.8 | An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary commands on the underlying operating system. | Sep 01, 2026 |
| CVE-2026-73750 | HIGH | 8.8 | Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacker could exploit these vulnerabilities by providing specially … | Sep 01, 2026 |
| CVE-2026-73749 | CRITICAL | 9.8 | Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote attacker could exploit these vulnerabilities … | Sep 01, 2026 |
| CVE-2026-73524 | MEDIUM | 6.1 | Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads … | Sep 01, 2026 |
| CVE-2026-71981 | HIGH | 8.8 | Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object … | Sep 01, 2026 |
| CVE-2026-63435 | MEDIUM | 5.3 | Mail is an internet library for Ruby designed to handle email generation, parsing, and sending. Prior to 2.9.1, Mail::Utilities.q_value_decode and Mail::Utilities.b_value_decode used a single String#match … | Sep 01, 2026 |
| CVE-2026-84309 | UNKNOWN | — | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child … | Sep 01, 2026 |
| CVE-2026-84308 | MEDIUM | 6.3 | phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php performs data-dependent conditional modular reductions in add() … | Sep 01, 2026 |
| CVE-2026-84307 | LOW | 3.7 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating … | Sep 01, 2026 |
| CVE-2026-78608 | MEDIUM | 6.5 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM … | Sep 01, 2026 |
| CVE-2026-78607 | MEDIUM | 5.4 | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges … | Sep 01, 2026 |
| CVE-2026-78606 | MEDIUM | 4.2 | Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Where … | Sep 01, 2026 |
| CVE-2026-78605 | MEDIUM | 5.9 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HTTP Request Smuggling (CAPEC-33). Under specific proxy deployment … | Sep 01, 2026 |
| CVE-2026-78603 | MEDIUM | 4.3 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch … | Sep 01, 2026 |
| CVE-2026-78597 | MEDIUM | 4.3 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An … | Sep 01, 2026 |
| CVE-2026-78592 | HIGH | 7.3 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Kibana can lead to the unauthorized deletion of privileged resources via Path … | Sep 01, 2026 |
| CVE-2026-77223 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Sep 01, 2026 |
| CVE-2026-77222 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Sep 01, 2026 |
| CVE-2026-77221 | UNKNOWN | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | Sep 01, 2026 |
| CVE-2026-76658 | CRITICAL | 10.0 | A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access … | Sep 01, 2026 |
| CVE-2026-76657 | CRITICAL | 10.0 | Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. … | Sep 01, 2026 |
| CVE-2026-73748 | LOW | 2.2 | A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. … | Sep 01, 2026 |
| CVE-2026-73747 | LOW | 2.5 | A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user with local access … | Sep 01, 2026 |
| CVE-2026-73746 | LOW | 3.1 | A denial-of-service vulnerability exists in the API of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial … | Sep 01, 2026 |