CVE-2026-76733 is a denial-of-service vulnerability in the API endpoint of Hewlett Packard Enterprise (HPE) Networking Instant On. It requires an authenticated attacker with administrative privileges to exploit. Successful exploitation causes a denial of service that interrupts normal operation but the service resumes automatically without manual intervention. The vulnerability affects versions up to and including 3.4.1.0. The CVSS score is 4.9, indicating medium severity.
CVE-2026-76732 is a local privilege-escalation vulnerability in the daemon component of Hewlett Packard Enterprise (HPE) Instant ON Networking devices. Exploiting this flaw could allow a local attacker with certain preconditions to execute arbitrary code with root privileges. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. The CVSS v3.1 base score is 6.4, indicating a medium severity level. No vendor patch or official remediation details are provided, and there are no known exploits in the wild at this time.
CVE-2026-76731 is an authentication bypass vulnerability in the captive portal of Hewlett Packard Enterprise (HPE) Networking Instant On. It allows an unauthenticated remote attacker to circumvent authentication controls, potentially gaining limited access to some data and making limited changes within the affected component. The vulnerability affects versions up to and including 3.4.1.0. The CVSS 3.1 base score is 6.5, indicating a medium severity level.
CVE-2026-76730 is an authentication bypass vulnerability in the PAPI protocol of Hewlett Packard Enterprise (HPE) Instant ON Access Points. It allows an unauthenticated adjacent attacker to bypass authentication controls and send unauthorized network traffic to the device. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. The CVSS score is 6.5, indicating a medium severity level. No known exploits are reported in the wild, and no official patch information is provided.
CVE-2026-76729 is a format string vulnerability in the API endpoint of Hewlett Packard Enterprise (HPE) Instant ON networking access points. It requires an authenticated attacker with high privileges to exploit. Successful exploitation could lead to memory corruption, potentially causing denial-of-service or remote code execution on the affected device. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. The CVSS 3.1 base score is 6.6, indicating a medium severity level.
CVE-2026-76728 is a high-severity vulnerability in Hewlett Packard Enterprise (HPE) Instant ON networking access points. It involves an API endpoint susceptible to server-side request forgery (SSRF) attacks by authenticated users with high privileges. Exploiting this flaw could enable attackers to execute arbitrary commands with privileged access on the underlying operating system. The affected versions include all releases up to and including 3.4.1.0. No known exploits are reported in the wild, and no patch information is provided.
CVE-2026-76727 is a command injection vulnerability in Hewlett Packard Enterprise (HPE) Instant ON networking devices. It affects versions from 0.0.0.0 up to and including 3.4.1.0. An authenticated remote attacker with high privileges could exploit this flaw to execute arbitrary commands on the underlying operating system. The vulnerability has a high severity rating with a CVSS score of 7.2. No patch or vendor advisory information is provided regarding remediation status.
CVE-2026-76726 is an authentication bypass vulnerability in the API endpoint of Hewlett Packard Enterprise (HPE) Networking Instant ON. This flaw could allow an unauthenticated remote attacker to bypass network access controls if certain external preconditions are met. Exploitation may lead to unauthorized access to restricted networks. The vulnerability affects versions up to and including 3.4.1.0. It has a high severity rating with a CVSS score of 8.1. No official patch or remediation details are provided in the available data.
CVE-2026-76725 is a critical vulnerability in the management protocol of Hewlett Packard Enterprise (HPE) Instant ON Access Points. It allows an unauthenticated adjacent attacker to bypass authentication controls, potentially leading to remote code execution with elevated privileges. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. The CVSS 3.1 base score is 9.6, indicating a high severity with network attack vector requiring adjacency, low attack complexity, no privileges or user interaction needed, and complete confidentiality, integrity, and availability impact.
CVE-2026-76724 is a critical command injection vulnerability in the CLI of Hewlett Packard Enterprise (HPE) Instant ON networking access points. An unauthenticated adjacent attacker can exploit this flaw by sending specially crafted packets, allowing arbitrary command execution with privileged user rights on the underlying operating system. The vulnerability affects versions up to and including 3.4.1.0. No known exploits are reported in the wild, and no patch information is currently provided.
CVE-2026-76723 is a critical buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) Instant ON Networking APS. It allows an unauthenticated adjacent attacker to execute arbitrary commands on the underlying operating system, potentially leading to full system compromise. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. There is no information provided about an available patch or vendor advisory. The CVSS score is 9.6, indicating a critical severity level.
CVE-2026-76722 is a critical uncontrolled format string vulnerability in Hewlett Packard Enterprise (HPE) Instant ON networking access points. It allows an unauthenticated remote attacker to execute arbitrary commands on the device, potentially causing denial of service or remote code execution. The vulnerability affects versions up to and including 3.4.1.0. No patch information is provided, and no known exploits are reported in the wild.
CVE-2026-76721 is a critical buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) Instant ON networking product. It allows an unauthenticated remote attacker to execute arbitrary code with privileged operating system rights. The vulnerability affects versions from 0.0.0.0 up to and including 3.4.1.0. No patch information is provided, and no known exploits are reported in the wild.
Threat actors exploited ChatGPT's Custom GPT feature to impersonate legitimate ChatGPT models, directing victims through sponsored Google ads to malicious Custom GPTs titled 'Plus 5.6'. These instances served fake service availability notices, redirecting users to Google Sites pages hosting ClickFix lures disguised as CloudFlare CAPTCHA checks. Victims were tricked into executing PowerShell commands that downloaded malicious MSI installers. The attack chain employed DLL sideloading through legitimate Canon-signed and later Stardock-signed executables, establishing dual persistence mechanisms via registry Run keys and scheduled tasks. The multi-stage infection involved obfuscated scripts, encrypted payloads hidden in WAV files and NuGet packages, and ultimately deployed a feature-rich remote access trojan with capabilities including remote desktop, browser hijacking, credential theft, and follow-on payload delivery. Huntress investigated approximately 40 incidents linked to this campaign, with confirmed Cus...
Liberu CRM versions from 0.9.1 up to but not including 10.0.0 have a broken access control vulnerability. This flaw allows users with a pending team invitation to escalate privileges by inviting additional accounts with admin rights. The vulnerability arises from improper authorization checks in the TeamPolicy::addTeamMember() function, which grants invitation rights based only on the presence of a matching pending invitation email. Attackers can exploit this by sending a crafted POST request to the team-invitations endpoint, specifying an admin role for a second account. Upon acceptance, the second account gains full administrative access to all team-scoped data.
This is an academic study survey seeking input from cybersecurity professionals working with AI-assisted tools in small and medium-sized enterprises (SMEs). The study aims to understand trust in AI cybersecurity tools and decision-making styles. It does not describe a security vulnerability, threat, or exploit.
CVE-2026-102829 is a critical OS command injection vulnerability in the steveukx git-js package, specifically related to the argv-parser dependency prior to version 2.0.1. The flaw allows an attacker to influence environment variables, causing Git to invoke an attacker-controlled editor during certain Git operations. This can lead to arbitrary command execution with the privileges of the Node.js process running git-js. The issue is fixed in argv-parser version 2.0.1.
CVE-2026-102616 is a medium severity SQL injection vulnerability in risesoft-y9 WorkFlow-Engine versions 9.6.0 through 9.6.10. The flaw exists in the getByIdAndYear function of the CustomHistoricProcessServiceImpl.java file within the OAuth2 Resource Filter component. It allows remote attackers to manipulate the year or processInstanceId arguments to perform SQL injection at two independent injection points. The vendor has not responded to disclosure attempts, and public exploit code is available.
A command injection vulnerability exists in the steveukx git-js library (simple-git) versions 3.15.0 through 4.0.0. The default blockUnsafeOperationsPlugin does not treat trailer.<token>.cmd as unsafe, allowing attacker-controlled input via SimpleGitOptions.config or inline -c arguments to execute arbitrary shell commands with the Node.js process's OS permissions. This issue is fixed in version 4.0.1.
CVE-2026-102827 is a command injection vulnerability in the steveukx git-js library prior to version 4.0.0. The issue arises because the default blockUnsafeOperationsPlugin does not properly handle unambiguous long-option abbreviations in Git commands, allowing attacker-controlled push arguments to bypass detection. This can lead to arbitrary command execution when git push is invoked with maliciously crafted arguments. The vulnerability is fixed in version 4.0.0.