Threat database

CVE-2026-95725 is an authenticated local command injection vulnerability in the VIA client for Linux by Hewlett Packard Enterprise. A low-privileged local attacker could exploit this flaw to execute arbitrary commands with elevated privileges on the affected system. The vulnerability affects VIA client versions from 0.0.0 up to and including 4.7.8. The CVSS v3.1 base score is 7.8, indicating a high severity impact.

CVE-2026-95724 is an improper certificate validation vulnerability in HPE Networking Virtual Intranet Access (VIA). It allows an unauthenticated remote attacker to bypass authentication mechanisms, potentially leading to disclosure of sensitive information. The vulnerability affects versions up to and including 4.7.8. It has a high severity with a CVSS score of 8.1.

CVE-2026-95723 is a high-severity vulnerability in Hewlett Packard Enterprise's Virtual Intranet Access (VIA) client. It involves missing integrity verification that allows a low-privileged local attacker to execute arbitrary code with elevated privileges on the operating system. The affected versions range from 0.0.0 up to and including 4.7.8. This vulnerability does not require user interaction and has a complex scope change, impacting confidentiality and integrity with high severity.

CVE-2026-95722 is a local privilege escalation vulnerability in the Hewlett Packard Enterprise Virtual Intranet Access (VIA) client. It allows a local attacker with low privileges to execute arbitrary commands with elevated privileges on the underlying operating system. The vulnerability affects VIA client versions up to and including 4.7.8. It has a high severity with a CVSS score of 8.8.

Network UPS Tools (nut) versions 2.8.3 through 2.8.5 contain an OS command injection vulnerability in the upsmon component. The upsmon client inserts the server-supplied ups.alarm value into shell commands executed by notify functions. If an operator configures NOTIFYCMD with EXEC in NOTIFYFLAG ALARM, shell metacharacters in the alarm text can be executed, allowing arbitrary command execution as the upsmon user, often root. This can be exploited via a malicious or compromised upsd server, a man-in-the-middle on an unencrypted connection, or a compromised UPS device. The vulnerability is fixed in version 2.8.6.

Chamilo LMS versions prior to 1.11.40 and between 2.0.0 and before 2.0.1 contain a SQL injection vulnerability in the get_sessions action of /main/inc/ajax/model.ajax.php. An authenticated administrator can exploit this by sending a crafted JSON filters parameter with a malicious groupOp field, allowing SQL syntax injection. This flaw enables unauthorized data disclosure, modification, deletion, and denial of service via delayed queries. The vulnerability is fixed in versions 1.11.40 and 2.0.1.

CVE-2026-121577 is a vulnerability in the whatstk library (versions >=0.2.0 and <0.9.0) where inefficient regular expression complexity in the generate_regex() function can cause excessive CPU consumption or uncaught exceptions when parsing chat exports. This occurs because the header format's date separator from the input is used unescaped in the regex pattern, allowing certain metacharacters to alter the pattern and cause performance degradation or errors. The issue is fixed in version 0.9.0.

CVE-2026-63433 is a Cross-Site Request Forgery (CSRF) vulnerability in franklioxygen MyTube versions prior to 1.10.6. The issue arises because the CSRF protection middleware incorrectly exempts requests based solely on the presence of an x-api-key header or Authorization: ApiKey value without validating the API key. When combined with permissive CORS settings, an attacker can trick an authenticated administrator into sending unauthorized state-changing requests, bypassing CSRF token validation. This can lead to destructive administrative actions such as deleting media or changing subscriptions. The vulnerability is fixed in version 1.10.6.

CVE-2026-95777 is a low-severity vulnerability in the management interface of HPE Networking Fabric Composer that allows a low-privileged authenticated attacker to disclose certain sensitive information stored on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0. No public exploits or active exploitation in the wild have been reported.

CVE-2026-95776 is an authenticated path traversal vulnerability in the API of HPE Networking Fabric Composer. It affects versions from 7.0.0 up to and including 7.4.0. An authenticated low-privileged user could exploit this vulnerability if certain external preconditions are met, potentially allowing them to read specific files on the underlying operating system. The vulnerability has a low CVSS score of 3.1, indicating limited impact and complexity. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.

CVE-2026-95775 is an authenticated local information disclosure vulnerability in HPE Networking Fabric Composer. It allows a low-privileged local attacker to read certain files on the underlying operating system. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS score is 3.3, indicating low severity.

CVE-2026-95774 is a low-severity vulnerability in HPE Networking Fabric Composer that allows an unauthenticated remote attacker to disclose sensitive information. The flaw affects versions from 7.0.0 up to and including 7.4.0. Exploitation does not require user interaction or privileges but has a high attack complexity. The vulnerability impacts confidentiality but not integrity or availability.

CVE-2026-95773 is a low-severity authenticated local denial-of-service vulnerability in HPE Networking Fabric Composer. A low-privileged local attacker could exploit this flaw to cause a partial denial-of-service affecting other workloads on the same host. The affected versions include 7.0.0 through 7.3.4 and version 7.4.0. No public exploits or known active exploitation have been reported. The vulnerability does not impact confidentiality or integrity, only availability.

CVE-2026-95772 is a race condition vulnerability in the API of HPE Networking Fabric Composer. It allows an authenticated attacker with low privileges to corrupt the configuration state of the system. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS score is 4.2, indicating medium severity.

CVE-2026-95771 is an authenticated information disclosure vulnerability in an API endpoint of HPE Networking Fabric Composer. An authenticated remote attacker could exploit this flaw to obtain limited information about the affected system. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS 3.1 base score is 4.3, indicating medium severity. There is no indication of public exploits or active exploitation in the wild. No patch or remediation details are provided in the available data.

CVE-2026-95770 is a medium-severity vulnerability in HPE Networking Fabric Composer that allows an authenticated low-privileged local user to disclose sensitive information from the underlying operating system. Exploitation requires local access and certain conditions outside the attacker's control. No known exploits are reported in the wild, and no patch information is provided.

CVE-2026-95769 is an unauthenticated audit log spoofing vulnerability in the API of HPE Networking Fabric Composer. An attacker could remotely falsify the client address recorded in audit logs without authentication. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS score is 5.3, indicating a medium severity impact primarily on the integrity of audit records.

CVE-2026-95768 is a privilege escalation vulnerability in the API of HPE Networking Fabric Composer. It allows an authenticated low-privileged remote attacker to obtain sensitive information if certain conditions outside the attacker's control are met. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS score is 5.3, indicating medium severity.

CVE-2026-95767 is an unauthenticated information disclosure vulnerability in the API of HPE Networking Fabric Composer. An attacker without authentication can remotely obtain sensitive information from the affected system. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS 3.1 base score is 5.3, indicating a medium severity impact focused on confidentiality loss without integrity or availability impact.

CVE-2026-95766 is a medium severity vulnerability in HPE Networking Fabric Composer that allows an authenticated attacker with low privileges to disclose sensitive information. The vulnerability affects versions from 7.0.0 through 7.4.0 inclusive. Exploitation requires network access and low privilege authentication, and it does not impact integrity or availability.