CVE-2026-110220

Kubeflow Model Registry through 0.3.17 SSRF via InferenceService Controller URL Annotation

Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService pointing the annotation at their server, capture the bearer token, and modify other tenants' InferenceServices cluster-wide.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kubeflow

Products

Model Registry

CVE-2026-110111

Xen Orchestra before 6.9.0 Privilege Escalation via Prototype Pollution in vm.importFromEsxi

Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at a malicious ESXi host serving a crafted .vmx file with __proto__.permission set, polluting Object.prototype so permission-less accounts inherit admin rights and enabling remote code execution.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Vatesfr Xen-orchestra

Products

Xen-orchestra Xen Orchestra Server

CVE-2026-116612

Arbitrary Pipeline Definition in GStreamer Editing Services Enables Local File Manipulation and Possible Code Execution

A flaw was found in GStreamer Editing Services (gst-editing-services). A GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When such a file is loaded, either explicitly by an editing application or automatically by a media player or file-manager thumbnailing service that uses GStreamer autoplugging, the pipeline description is parsed and instantiated without restriction on which elements may be used or which properties may be set. A remote attacker who can deliver a crafted project file to a victim's system can trigger reading or writing of arbitrary local files, issue outbound network requests to attacker-controlled servers, or cause the application to crash. Under certain conditions the file-write capability may be leveraged to achieve code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-79889

Multiple Unauthenticated Buffer Overflow vulnerabilities in AOS-8 Web Interface result in Remote Code Execution

Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79890

Unauthenticated Command Injection Vulnerabilities in AOS-8 Accessed by the PAPI Protocol

There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79891

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8

A buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79892

Authenticated Local Memory Corruption Vulnerability leads to Arbitrary Code Execution in AOS-8

A memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code. Successful exploitation could allow the attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79893

Unauthenticated Memory Corruption Vulnerabilities lead to Denial-of-Service in AOS-10

Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79895

Unauthenticated Remote Denial-of-Service (DoS) Vulnerabilities in AOS-10

Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected interface.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79955

Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in AOS-8

An unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-79956

Improper Sanitization leads to Command Injection in AOS-8 Web Interface

A vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system. Successful exploitation could allow an attacker to run unauthorized commands on the system, potentially leading to system compromise.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95704

Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface

A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95705

Authenticated Command Injection Vulnerabilities in AOS-8

Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95707

Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-8

A buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95708

Authenticated File Write leads to Command Injection Vulnerabilities in AOS-10

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95709

Authenticated Command Injection Vulnerabilities in AOS-10

Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95711

Authentication Bypass Leading to Remote Code Execution in AOS-10 Web-Based Management Interface

An authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the underlying operating system.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95713

Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in AOS-8 Command Line Interface

An unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected interface, along with limited access to or modification of some system data.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95714

Authenticated Adjacent Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10

A buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Aos

CVE-2026-95715

Unauthenticated Local Command Injection Vulnerability in AOS-10 Command Line Interface

An unauthenticated command injection vulnerability exists in the command line interface of AOS-10. Successful exploitation could allow an attacker with physical access to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 6.8 Medium EPSS 1.6% KEV · Not listed

Vendors

Hpe

Products

Aos