CVE-2026-95776 is an authenticated path traversal vulnerability in the API of HPE Networking Fabric Composer. It affects versions from 7.0.0 up to and including 7.4.0. An authenticated low-privileged user could exploit this vulnerability if certain external preconditions are met, potentially allowing them to read specific files on the underlying operating system. The vulnerability has a low CVSS score of 3.1, indicating limited impact and complexity. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.
CVE-2026-95771 is an authenticated information disclosure vulnerability in an API endpoint of HPE Networking Fabric Composer. An authenticated remote attacker could exploit this flaw to obtain limited information about the affected system. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS 3.1 base score is 4.3, indicating medium severity. There is no indication of public exploits or active exploitation in the wild. No patch or remediation details are provided in the available data.
CVE-2026-95767 is an unauthenticated information disclosure vulnerability in the API of HPE Networking Fabric Composer. An attacker without authentication can remotely obtain sensitive information from the affected system. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS 3.1 base score is 5.3, indicating a medium severity impact focused on confidentiality loss without integrity or availability impact.
CVE-2026-95760 is a privilege escalation vulnerability in the API of HPE Networking Fabric Composer. It requires certain preconditions outside the attacker's control to be met. An authenticated attacker with low privileges could exploit this flaw to gain elevated privileges on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive. The CVSS v3.1 base score is 6.4, indicating a medium severity level.
CVE-2026-95757 is a local authentication bypass vulnerability in the API of HPE Networking Fabric Composer. It allows a low-privileged local attacker to write arbitrary files to remote servers configured on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0. The CVSS 3.1 base score is 6.5, indicating a medium severity level. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.
CVE-2026-95753 is a privilege escalation vulnerability in the API of HPE Networking Fabric Composer. An authenticated attacker with low privileges could exploit this flaw to disclose network traffic from switches managed by Fabric Composer. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. It has a CVSS 3.1 score of 7.1, indicating high severity.
CVE-2026-95752 is a local privilege escalation vulnerability in the API of HPE Networking Fabric Composer. It allows a low-privileged local attacker to elevate their privileges on the affected system. The vulnerability affects versions 7.0.0 through 7.4.0 inclusive. The CVSS v3.1 base score is 7.1, indicating high severity with impact on integrity and availability but no confidentiality impact.
CVE-2026-95747 is a privilege escalation vulnerability in the SSH interface of HPE Networking Fabric Composer. It allows an authenticated low-privileged attacker to potentially gain unauthorized access to internal services if certain external conditions are met. The vulnerability affects versions from 7.0.0 up to and including 7.4.0. The CVSS 3.1 base score is 7.5, indicating high severity.
CVE-2026-95743 is a local privilege escalation vulnerability in the underlying operating system of HPE Networking Fabric Composer. It allows a local attacker with low privileges to gain elevated privileges on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive. The CVSS v3.1 base score is 7.8, indicating a high severity level.
CVE-2026-95740 is an improper certificate validation vulnerability in HPE Networking Fabric Composer. It allows an unauthenticated adjacent attacker to intercept communications between the affected system and remote servers under certain conditions. Exploitation can lead to sensitive information disclosure. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive. The CVSS 3.1 score is 8.0, indicating high severity.
CVE-2026-95739 is a vulnerability in the API of HPE Networking Fabric Composer that allows unauthenticated attackers to perform brute-force attacks due to improper restriction of excessive authentication attempts. Exploiting this flaw could lead to administrative access on the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 through 7.4.0 inclusive. It has a high severity with a CVSS score of 8.1.
CVE-2026-95738 is an authentication bypass vulnerability in HPE Networking Fabric Composer. It allows an unauthenticated remote attacker to bypass authentication controls under certain conditions outside the attacker's control. Successful exploitation could grant administrative access to the affected system. The vulnerability affects Fabric Composer versions from 7.0.0 up to and including 7.4.0. The issue is rated high severity with a CVSS score of 8.1.
CVE-2026-95731 is a critical vulnerability in HPE Networking Fabric Composer's command-line interface involving hardcoded passwords. This flaw allows unauthenticated remote attackers to gain unauthorized administrative access with elevated privileges. The affected versions include 7.0.0 through 7.3.4 and version 7.4.0. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
A missing authorization vulnerability exists in Uncanny Owl Uncanny Automator up to version 7.7.1. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized actions that impact the integrity of the system. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CTFd versions from 3.1.0 up to but not including 3.8.7 have an information disclosure vulnerability in the /api/v1/teams list endpoint. This flaw allows unauthenticated attackers to paginate through team data and access non-public custom field values such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
DbGate versions prior to 7.3.3 have a missing authorization vulnerability that allows authenticated users with connection restrictions to bypass LOGIN_PERMISSIONS. This occurs because the test() and save() functions do not call testConnectionPermission, enabling attackers to submit arbitrary connection definitions to probe internal database hosts or overwrite stored connections.
A vulnerability in the armurox loggingredactor Python library prior to version 0.0.7 allows sensitive information to be logged without redaction when non-primitive objects with custom __str__ or __repr__ methods are logged. This causes personally identifiable information to appear in logs that are expected to mask such data. The issue is fixed in version 0.0.7.
CVE-2026-121511 is a heap out-of-bounds read vulnerability in the µD3TN BPv6/BPv7 Fragmenter component. It allows a local attacker to read memory beyond the intended buffer and reliably cause a denial-of-service (DoS) condition. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity. No affected versions or patch information are provided in the available data.
Wasmtime versions 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contain a vulnerability where forwarded trailers in HTTP requests or responses are not properly checked against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. This allows WASIp3 guests to bypass embedder-customized forbidden header filtering, potentially undermining intended header restrictions.
Wasmtime versions before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contain a request smuggling vulnerability in the wasi-http component. This flaw allows malicious guests to set multiple conflicting content-length headers, potentially causing the host to send HTTP requests with conflicting content-length values. Such requests can be used to smuggle requests through servers or intermediaries that do not reject them. The vulnerability has a low severity score and no known exploits in the wild.