Search vulnerabilities

Expected end of text, found '\' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,866

CVE-2026-76713

Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an authenticated remote attacker to gain unauthorized access to the file system with root privileges, potentially resulting in full system compromise.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Analytics And Location Engine Ale
CVE-2026-76712

Unauthenticated Remote Unauthorized Access, Information Disclosure, and Denial of Service Vulnerabilities in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial of service. An unauthenticated remote attacker could exploit the vulnerable system by sending specially crafted input or intercepting network communications. Successful exploitation could result in the disclosure of sensitive information, bypass of security controls, or a denial of service condition on the affected system.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Analytics And Location Engine Ale
CVE-2026-76709

Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Analytics And Location Engine Ale
CVE-2026-76710

Unauthenticated Remote Sensitive Information Disclosure Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful exploitation could result in the disclosure of sensitive site hierarchy, infrastructure details, and client device information.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Analytics And Location Engine Ale
CVE-2026-76711

Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE)

A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful exploitation could result in unauthorized data injection.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe)
Products
Analytics And Location Engine Ale
CVE-2026-101051

Cloudreve before 4.16.1 Path Traversal via Remote Download

Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside the selected destination directory. Attackers can exploit path traversal sequences in downloader metadata to write files to unexpected locations within accessible namespaces.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Cloudreve
Products
Cloudreve
CVE-2026-101059

utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Universal-tool-calling-protocol
Products
Python-utcp
CVE-2026-76685

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated input. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input that triggers an integer overflow. Successful exploitation could result in a buffer overflow, potentially leading to remote code execution or denial-of-service.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76689

Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability exists in the configuration processing logic of the affected component where malformed input is improperly processed. An authenticated remote attacker with administrative privileges could exploit this vulnerability by providing specially crafted configuration data. Successful exploitation could result in a stack-based buffer overflow, potentially leading to remote code execution with root privileges or a denial of service due to a system crash.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76682

Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability in the network security monitoring component of intrusion detection systems could allow an unauthenticated remote attacker to exploit a limited buffer overflow. Successful exploitation could allow an attacker to cause a denial-of-service or potentially execute arbitrary code on the system.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76686

Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability exists in the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an unauthenticated remote attacker to conduct a denial-of-service attack on the affected service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76690

Authenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected component. Successful exploitation could result in remote code execution as root.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76691

Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateway API Endpoint

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76698

Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with limited access privileges could exploit this vulnerability through specially crafted input. Successful exploitation, under certain conditions, could result in the execution of arbitrary commands with elevated privileges or a denial-of-service condition on the affected appliance.

CVSS 3.1 · 6.5 Medium EPSS 4.5% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76700

Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways

Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76699

Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways

A buffer overflow vulnerability exists in a system service within the underlying operating system of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated adjacent attacker to cause a denial-of-service. Successful exploitation could allow an attacker to crash the impacted service and temporarily disrupting network operations.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76683

Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System
CVE-2026-76701

Unauthenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking EdgeConnect SD-WAN Gateways.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Arubanetworks Hewlett Packard Enterprise (hpe) Hpe
Products
Edgeconnect Sd-wan Orchestrator Edgeconnect Sd-wan Gateways Edgeconnect Operating System