CVE-2026-110230

XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint

XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route. Attackers can supply sequential upload ids to MediaController::createVanity() to break existing share links and hijack the freed codes with their own uploads.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sergix44

Products

Xbackbone

CVE-2026-110232

Fossify File Manager through 1.6.2 Zip Slip Path Traversal via DecompressActivity

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Fossify

Products

Fossify File Manager

CVE-2026-110233

rovr through 0.10.3 OS Command Injection via Unquoted Path to cmd.exe

Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names. Attackers can deliver a file named with shell metacharacters like & alongside a payload, which runs with user privileges when the file is opened through open_file.

CVSS 4.0 · 8.4 High EPSS 1.2% KEV · Not listed

Vendors

Nspc911

Products

Rovr

CVE-2026-97788

Active Directory Federation Services (AD FS) Information Disclosure Vulnerability

Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

.net .net Framework Windows 10 1607 and 27 more

CVE-2026-110639

@mborne/extract before 0.2.1 OS Command Injection via archivePath and targetDir

@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath or targetDir options. Attackers controlling these values passed to extract() can inject commands into unquoted shelljs exec() strings in the unzip, 7z, tar-bz2 and gz extractors, running them with Node.js process privileges.

CVSS 4.0 · 9.3 Critical EPSS 2.7% KEV · Not listed

Vendors

Mborne

Products

Extract

CVE-2026-108335

Password Reset Functionality Missing Brute-Force Protection

When the password reset functionality is enabled, and email is configured, an attacker could take over any account using a brute-force attack. There is no rate limiting on the attempts to enter the reset code, leading to the possibility of a brute force solution to the password reset challenge. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Hitachi

Products

Vantara Remote Ops Agent

CVE-2026-108336

Token Signing Key Allows Unauthenticated Administrative Access

When the default self-signed certificate is used, an attacker could gain administrative access to the application. The SSL certificate for the web interface is used to sign JWT access tokens that are used to validate that the user is logged in. When the default SSL certificate is used, an attacker could have the capability to sign JWT access tokens and bypass login. An attacker could gain administrative access to the application and perform actions like configuring the service or requesting log collection. Device credentials and customer data cannot be accessed with this vulnerability.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Hitachi

Products

Vantara Remote Ops Agent

CVE-2026-108337

Password Reset Code Accessible in User Listing API

An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Hitachi

Products

Vantara Remote Ops Agent

CVE-2026-102298

Insufficient Authorization and User Boundary Validation in Omada Controller MSP

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication.  Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Omada Software Controller

CVE-2026-73799

HPE NonStop SNMP Trap Multiplexer - Memory Corruption vulnerability

A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Snmp Trap Multiplexer

CVE-2026-76656

HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability

A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Tcp/ip Utilities

CVE-2026-76659

HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability

A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Tcp/ip Utilities

CVE-2026-79822

HPE NonStop TNS/X Native Inspect - Execution flow vulnerability

A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Tns/x Native Inspect

CVE-2026-101290

CVE-2026-101290

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Sick Ag

Products

Sick Safetyscanners Base Cpp Driver

CVE-2026-79823

HPE NonStop EMS Distributor - Buffer Overflow vulnerability

HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Ems Distributor

CVE-2026-47786

Pre-Authentication Command Injection

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Qnap Systems

Products

Hybriddesk Station

CVE-2026-79827

HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Inspect Subsystem

CVE-2026-79828

HPE NonStop Debug Utilities - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Debug Utilities

CVE-2026-79829

HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Http Webserver

CVE-2026-110726

Default Rate‑Limit Key Resolver Allows Unlimited Bypass via X‑Forwarded‑For Manipulation

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Connected Services Platform