CVE-2026-76751 is a critical vulnerability in the OnGuard agent of Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM). It involves a missing integrity verification that could allow an unauthenticated remote attacker to execute arbitrary code with elevated privileges. The vulnerability affects specific versions of CPPM, potentially leading to full compromise of the affected endpoint.
CVE-2026-76750 is a critical deserialization vulnerability in the web interface of Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). It allows an unauthenticated remote attacker to execute arbitrary code on the affected system. The vulnerability affects specific versions of CPPM, including 6.11.0 through 6.11.15 and version 6.14.0. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed.
CVE-2026-76749 is a medium severity vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) that allows an unauthenticated remote attacker to disclose sensitive information. The vulnerability affects versions from 16.11.0000 through 16.11.0031 inclusive. Exploitation does not impact integrity or availability but can lead to high confidentiality loss. No known exploits are reported in the wild, and no patch or remediation information is currently provided.
CVE-2026-76748 is a privilege escalation vulnerability in the API of Hewlett Packard Enterprise's AOS-Switch (AOS-S). An authenticated user with read-only access can exploit this flaw to gain administrative privileges on the affected system. The vulnerability affects versions from 16.11.0000 up to and including 16.11.0031. It has a high severity rating with a CVSS score of 8.8. No information about available patches or vendor advisories is provided.
CVE-2026-76747 is a critical buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) firmware versions 16.11.0000 through 16.11.0031. An unauthenticated remote attacker could exploit this flaw to expose sensitive memory contents and cause a denial of service on the affected device.
CVE-2026-76746 is a critical unauthenticated buffer overflow vulnerability in Hewlett Packard Enterprise's AOS-Switch (AOS-S). An adjacent attacker without authentication can exploit this flaw to expose sensitive memory contents and cause a denial of service on the affected device. The vulnerability affects versions from 16.11.0000 through 16.11.0031 inclusive. No patch or remediation information is provided in the available data. The CVSS 3.1 base score is 9.3, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and availability.
CVE-2026-76745 is a critical memory corruption vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) software. It can be exploited by an unauthenticated adjacent attacker to execute arbitrary code, potentially leading to full system compromise. The affected versions are from 16.11.0000 through 16.11.0031 inclusive. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.
CVE-2026-76744 is a critical buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) affecting versions 16.11.0000 through 16.11.0031. It allows an unauthenticated remote attacker to execute arbitrary code on the device. The vulnerability has a high CVSS score of 9.8, indicating severe impact to confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.
A critical vulnerability (CVE-2026-76743) exists in the management interface of Hewlett Packard Enterprise's AOS-Switch (AOS-S). This flaw allows an unauthenticated remote attacker to potentially bypass authentication controls under certain conditions not controlled by the attacker. Successful exploitation could lead to unauthorized access with full confidentiality, integrity, and availability impact. The affected versions are from 16.11.0000 through 16.11.0031 inclusive. No known exploits are reported in the wild, and no patch information is provided.
CVE-2026-76742 is a critical authentication bypass vulnerability in the web management interface of Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S). An unauthenticated remote attacker could exploit this flaw to gain unauthorized access to the affected system. The vulnerability affects versions from 16.11.0000 up to and including 16.11.0031. The CVSS 3.1 base score is 9.8, indicating a high impact on confidentiality, integrity, and availability.
CVE-2026-76741 is a buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) affecting versions 16.11.0000 through 16.11.0031. An authenticated remote attacker could exploit this flaw to cause a denial-of-service (DoS) condition. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS v3.1 base score is 6.5 (medium severity). No patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.
A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which could be chained to achieve remote code execution on the appliance. The secret scanning validator for GCP service account credentials trusted the token endpoint embedded in a committed credential and issued a request to it without restricting the destination. Exploitation required an authenticated user with permission to push to a repository on an instance with GitHub Advanced Security and secret scanning validity checks enabled, a non-default configuration. This vulnerability affected GitHub Enterprise Server 3.20, 3.21, and 3.22 and was fixed in versions 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported through the GitHub Bug Bounty program.
A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch to become the new default. In repositories that required pull-request review but did not restrict branch deletion, this bypassed the review requirement and caused fresh clones and default-branch API requests to use attacker-controlled content. This vulnerability affected supported GitHub Enterprise Server releases in the 3.18, 3.19, 3.20, 3.21, and 3.22 series and was fixed in versions 3.18.16, 3.19.13, 3.20.9, 3.21.7, and 3.22.2. This vulnerability was reported via the GitHub Bug Bounty program.
## Summary
Hydra's `instantiate()` API resolves and invokes Python callables named by the `_target_` field in configuration. The target blacklist introduced for CVE-2026-68508 was incomplete.
Representative bypasses included execution wrappers such as `timeit.timeit`, executable deserialization through `pickle.loads`, and generic dispatch or wrapper targets that obscured the effective callable. Target aliases, callable-returning helpers, and deferred dispatch could similarly bypass name-based checks.
An attacker who can cause an application to instantiate an untrusted Hydra configuration can use these gaps to execute code with the application's privileges.
## Fix
Hydra 1.3.6 expands and hardens the blacklist used by the 1.3 compatibility line. It blocks the reported execution and deserialization surfaces, checks canonical callable identities and aliases, mediates callable results, and blocks generic dispatch and wrapper targets that bypass immediate target checks.
The Hydra 1.3 blacklist is a best-effort, defense-in-depth measure. It is not a complete security boundary and does not make untrusted configuration safe to instantiate.
Hydra 1.4.0.dev9 applies the same hardening and introduces the execution whitelist as the recommended primary security boundary. When a whitelist is supplied, targets are rejected unless trusted Python code authorizes them. If no whitelist is supplied, Hydra preserves legacy behavior with a deprecation warning and the blacklist as a best-effort compatibility fallback. Targets that permit configuration to select or supply executable behavior remain non-whitelistable.
## Remediation
Upgrade to Hydra 1.3.6, or to Hydra 1.4.0.dev9 or later when testing the 1.4 prerelease line.
On Hydra 1.3, do not instantiate configuration from untrusted sources. On Hydra 1.4 and later, constrain untrusted configuration with a narrow execution whitelist supplied by trusted Python code.
For Hydra 1.4 execution-whitelist configuration, see: https://hydra.cc/docs/advanced/execution_whitelist/
CVE-2026-106441 is a high-severity code injection vulnerability in the hydra-ecosystem hydra project. The issue arises because Hydra passed its Python logging configuration directly to logging.config.dictConfig() without applying its target policy, allowing resolution and invocation of arbitrary importable classes and factories. This flaw enables an attacker who can control the logging configuration to execute arbitrary code with the application's privileges during logging setup. The vulnerability affects Hydra versions before 1.3.6 and prerelease versions from 1.4.0.dev0 up to but not including 1.4.0.dev9. Hydra 1.3.6 and later apply a hardened blacklist, and 1.4.0.dev9 and later introduce an execution whitelist to control callable invocation securely. Users are advised to upgrade to 1.3.6 or 1.4.0.dev9 or later and avoid composing logging configurations from untrusted sources.
Dell Command | Configure (DCC) versions prior to 5.2.3.35 contain a vulnerability due to the use of a hard-coded cryptographic key. This flaw could allow an unauthenticated attacker with local access to potentially disclose sensitive information. The vulnerability is identified as CWE-321 and has a medium severity rating with a CVSS score of 6.2.
MultiversX's multisig-improved (repository: mx-multisig-and-modules) reference implementation of their on-chain multisig smart contract system contains a vulnerability where a missing independent authorization check allows any account with the Proposer role to perform explicitly barred actions. This vulnerability allows the Proposer role to move funds alone, draining 100% of a contract's EGLD/ESDT balance in two transactions with zero signatures.
A high-severity vulnerability (CVE-2026-106440) exists in the hydra-ecosystem hydra framework, specifically in the hydra-optuna-sweeper package versions 1.2.0 up to but not including 1.3.0 and 1.4.0.dev4 up to but not including 1.4.0.dev10. The issue involves unsafe reflection where externally controlled input can specify a dotted path to Python code that is resolved and invoked without proper execution policy enforcement. This allows an attacker controlling Optuna sweep configuration or command-line overrides to execute arbitrary Python code with the application's privileges, bypassing trusted execution whitelists. The vulnerability is fixed in versions 1.3.0 and 1.4.0.dev10.
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template context. Attackers can craft a custom link template embedding request.COOKIES['sessionid'] or a user's API token into an img src URL, which bypasses the clean_html sanitizer and auto-exfiltrates the victim's credentials to an attacker-controlled host when a privileged user views the object, enabling full account takeover.
Dell Command | Configure (DCC) versions prior to 5.2.3.35 have a vulnerability involving improper handling of mixed encoding. This flaw could allow an unauthenticated remote attacker to elevate privileges on the affected system. The vulnerability is identified as CWE-175 and has a CVSS 3.1 score of 7.4, indicating high severity.