CVE-2026-95745 is a high-severity vulnerability in the API of HPE Networking Fabric Composer that allows an unauthenticated remote attacker to cause a denial of service (DoS). Exploiting this flaw can make the management services unavailable, impacting network management operations.
CVE-2026-95744 is a high-severity vulnerability in HPE Networking Fabric Composer that allows an authenticated low-privileged attacker to disclose sensitive information. Exploitation requires certain conditions outside the attacker's control and could lead to interception of protected network traffic.
CVE-2026-95743 is a local privilege escalation vulnerability in the underlying operating system of HPE Networking Fabric Composer. It allows a local attacker with low privileges to gain elevated privileges on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive. The CVSS v3.1 base score is 7.8, indicating a high severity level.
CVE-2026-95742 is an authenticated local arbitrary file write vulnerability in HPE Networking Fabric Composer. An attacker with local authenticated access could exploit this flaw to create or overwrite files on the system with elevated privileges, potentially compromising confidentiality, integrity, and availability. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0.
CVE-2026-95741 is a high-severity vulnerability in the API of HPE Networking Fabric Composer that involves missing integrity verification. An authenticated attacker with low privileges could exploit this flaw to gain elevated privileges on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive.
CVE-2026-95740 is an improper certificate validation vulnerability in HPE Networking Fabric Composer. It allows an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers under certain conditions. Exploitation can lead to sensitive information disclosure. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive. The CVSS 3.1 score is 8.0, indicating high severity.
CVE-2026-95739 is a vulnerability in the API of HPE Networking Fabric Composer that allows unauthenticated attackers to perform brute-force attacks due to improper restriction of excessive authentication attempts. Exploiting this flaw could lead to administrative access on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive. It has a high severity with a CVSS score of 8.1.
CVE-2026-95738 is an authentication bypass vulnerability in HPE Networking Fabric Composer. It allows an unauthenticated remote attacker to bypass authentication controls under certain conditions outside the attacker's control. Successful exploitation could grant administrative access to the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0. The issue is rated high severity with a CVSS score of 8.1.
CVE-2026-95737 is a local privilege escalation vulnerability in the underlying operating system of HPE Networking Fabric Composer. It allows a local attacker with high privileges to gain elevated privileges on the host OS. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0. The CVSS score is 8.2, indicating a high severity level.
CVE-2026-95736 is an improper certificate validation vulnerability in HPE Networking Fabric Composer. It can be exploited by an unauthenticated adjacent attacker under certain conditions outside the attacker's control. Successful exploitation could allow interception of sensitive information. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. It has a high severity with a CVSS score of 8.3.
CVE-2026-95735 is an improper certificate validation vulnerability in HPE Networking Fabric Composer. This flaw could allow an unauthenticated remote attacker, under certain conditions beyond their control, to obtain sensitive information including credentials. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0. It has a high severity rating with a CVSS score of 8.7.
CVE-2026-95734 is a high-severity vulnerability in the API of HPE Networking Fabric Composer that allows an authenticated low-privileged user to access sensitive information beyond their authorized privilege level. Exploiting this flaw could enable an attacker to obtain sensitive credentials stored on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive.
CVE-2026-95733 is a critical vulnerability in HPE Networking Fabric Composer involving the use of hardcoded credentials. An unauthenticated attacker on an adjacent network could exploit this flaw to execute arbitrary code on the affected system, potentially leading to full compromise. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0.
CVE-2026-95732 is a critical authentication bypass vulnerability in the underlying operating system of HPE Networking Fabric Composer. This flaw allows an unauthenticated adjacent attacker to execute arbitrary code on the affected system, potentially leading to full compromise. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive.
CVE-2026-95731 is a critical vulnerability in HPE Networking Fabric Composer's command-line interface involving hardcoded passwords. This flaw allows unauthenticated remote attackers to gain unauthorized administrative access with elevated privileges. The affected versions include 7.0.0 through 7.3.4 and version 7.4.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
CVE-2025-71452 is a medium severity cross-site scripting (XSS) vulnerability in Vembu BDRSuite versions before 7.6.0. It allows unauthenticated remote attackers to inject arbitrary JavaScript via unsanitized request parameters in the restore progress page. This can lead to session hijacking or manipulation of the user interface in the victim's browser. The issue is fixed in version 7.6.0.
A path traversal vulnerability (CWE-22) exists in isomorphic-git versions prior to 1.38.6. The issue occurs during git.checkout operations where symlinked leading directory components are not properly checked, allowing writes outside the intended working tree on Linux or macOS. This can lead to arbitrary file writes and potential code execution on the host. The vulnerability is fixed in version 1.38.6.
CVE-2025-71451 is a medium-severity cross-site scripting (XSS) vulnerability in Vembu BDRSuite versions before 7.6.0. It allows unauthenticated remote attackers to inject arbitrary JavaScript by manipulating certain request parameters. This vulnerability can lead to session hijacking or manipulation of the user interface in the victim's browser. The issue is fixed in version 7.6.0.
isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git persists server-supplied circular symref= capabilities through updateRemoteRefs, and GitRefManager.resolve() follows the resulting loose symbolic references without a default depth limit or cycle detection. After a clone from a malicious or man-in-the-middle-controlled remote, operations such as log, status, checkout, and branch that resolve refs/remotes/origin/a or refs/remotes/origin/b do not terminate. The circular references remain on disk, leaving the repository unusable for the application and causing a persistent denial of service. This issue is fixed in version 1.38.6.
A resource consumption vulnerability exists in isomorphic-git versions prior to 1.38.6. The library reads a server-controlled targetSize value when applying a packfile delta and uses it to allocate a Buffer without bounds. This can cause excessive memory allocation (~2 GB) before validating the delta output, potentially leading to process termination on memory-constrained environments. The issue is fixed in version 1.38.6.