Threat database

CVE-2026-79794 is a critical SQL injection vulnerability in the web-based management interface of Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). It allows an authenticated remote attacker to execute arbitrary database commands. The vulnerability affects specific versions of CPPM, potentially compromising confidentiality, integrity, and availability of the system.

CVE-2026-76754 is a critical SQL injection vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). It allows an unauthenticated remote attacker to execute arbitrary database commands via a vulnerable interface. The affected versions are 6.11.0 through 6.11.15 and version 6.14.0. The vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.

CVE-2026-76753 is a critical format string vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). It allows an unauthenticated remote attacker to corrupt process memory, potentially leading to arbitrary code execution. The vulnerability affects specific versions of CPPM. The CVSS score is 9.8, indicating high severity. No vendor patch or official remediation information is provided in the input data.

CVE-2026-76752 is a critical authentication bypass vulnerability in Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM). It affects specific versions of the product and allows unauthenticated remote attackers to bypass authentication controls via the web-based management and API interfaces. Successful exploitation grants administrative access to the system, posing a high risk to confidentiality, integrity, and availability.

CVE-2026-76751 is a critical vulnerability in the OnGuard agent of Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM). It involves a missing integrity verification that could allow an unauthenticated remote attacker to execute arbitrary code with elevated privileges. The vulnerability affects specific versions of CPPM, potentially leading to full compromise of the affected endpoint.

CVE-2026-76750 is a critical deserialization vulnerability in the web interface of Hewlett Packard Enterprise ClearPass Policy Manager (CPPM). It allows an unauthenticated remote attacker to execute arbitrary code on the affected system. The vulnerability affects specific versions of CPPM, including 6.11.0 through 6.11.15 and version 6.14.0. The CVSS score is 9.8, indicating a high severity with network attack vector, no privileges required, and no user interaction needed.

CVE-2026-76749 is a medium severity vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) that allows an unauthenticated remote attacker to disclose sensitive information. The vulnerability affects versions from 16.11.0000 through 16.11.0031 inclusive. Exploitation does not impact integrity or availability but can lead to high confidentiality loss. No known exploits are reported in the wild, and no patch or remediation information is currently provided.

CVE-2026-76748 is a privilege escalation vulnerability in the API of Hewlett Packard Enterprise's AOS-Switch (AOS-S). An authenticated user with read-only access can exploit this flaw to gain administrative privileges on the affected system. The vulnerability affects versions from 16.11.0000 up to and including 16.11.0031. It has a high severity rating with a CVSS score of 8.8. No information about available patches or vendor advisories is provided.

CVE-2026-76747 is a critical buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) firmware versions 16.11.0000 through 16.11.0031. An unauthenticated remote attacker could exploit this flaw to expose sensitive memory contents and cause a denial of service on the affected device.

CVE-2026-76746 is a critical unauthenticated buffer overflow vulnerability in Hewlett Packard Enterprise's AOS-Switch (AOS-S). An adjacent attacker without authentication can exploit this flaw to expose sensitive memory contents and cause a denial of service on the affected device. The vulnerability affects versions from 16.11.0000 through 16.11.0031 inclusive. No patch or remediation information is provided in the available data. The CVSS 3.1 base score is 9.3, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and availability.

CVE-2026-76745 is a critical memory corruption vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) software. It can be exploited by an unauthenticated adjacent attacker to execute arbitrary code, potentially leading to full system compromise. The affected versions are from 16.11.0000 through 16.11.0031 inclusive. The vulnerability has a high CVSS score of 9.6, indicating severe impact on confidentiality, integrity, and availability.

CVE-2026-76744 is a critical buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) affecting versions 16.11.0000 through 16.11.0031. It allows an unauthenticated remote attacker to execute arbitrary code on the device. The vulnerability has a high CVSS score of 9.8, indicating severe impact to confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

A critical vulnerability (CVE-2026-76743) exists in the management interface of Hewlett Packard Enterprise's AOS-Switch (AOS-S). This flaw allows an unauthenticated remote attacker to potentially bypass authentication controls under certain conditions not controlled by the attacker. Successful exploitation could lead to unauthorized access with full confidentiality, integrity, and availability impact. The affected versions are from 16.11.0000 through 16.11.0031 inclusive. No known exploits are reported in the wild, and no patch information is provided.

CVE-2026-76742 is a critical authentication bypass vulnerability in the web management interface of Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S). An unauthenticated remote attacker could exploit this flaw to gain unauthorized access to the affected system. The vulnerability affects versions from 16.11.0000 up to and including 16.11.0031. The CVSS 3.1 base score is 9.8, indicating a high impact on confidentiality, integrity, and availability.

CVE-2026-76741 is a buffer overflow vulnerability in Hewlett Packard Enterprise (HPE) AOS-Switch (AOS-S) affecting versions 16.11.0000 through 16.11.0031. An authenticated remote attacker could exploit this flaw to cause a denial-of-service (DoS) condition. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS v3.1 base score is 6.5 (medium severity). No patch or vendor advisory is provided in the data, and no known exploits are reported in the wild.

A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.

CVE-2026-76738 is a buffer overflow vulnerability in the API endpoint of Hewlett Packard Enterprise (HPE) Instant ON. It requires an authenticated attacker with administrative privileges to exploit. Successful exploitation can cause a denial of service by interrupting the normal operation of the affected service, which recovers automatically without manual intervention. The vulnerability has a low CVSS score of 2.7 and does not impact confidentiality or integrity.

CVE-2026-76737 is an authenticated path traversal vulnerability in the command line interface of Hewlett Packard Enterprise (HPE) Networking Instant On. An attacker with administrative privileges could exploit this flaw to modify certain files on the underlying operating system and disrupt the affected service's normal operation. The vulnerability affects versions up to and including 3.4.1.0. The CVSS score is 3.0, indicating low severity.

CVE-2026-76736 is a buffer overflow vulnerability in the underlying operating system of Hewlett Packard Enterprise (HPE) Instant ON networking devices. It can be exploited by a low-privilege authenticated local attacker to disrupt the normal operation of the affected service. The vulnerability does not impact confidentiality or integrity but can cause availability issues. The CVSS score is 3.3, indicating low severity. The affected versions are from 0.0.0.0 up to and including 3.4.1.0. There is no information about available patches or exploits in the wild.

CVE-2026-76735 is a medium severity vulnerability in Hewlett Packard Enterprise (HPE) Instant ON networking devices. It allows an authenticated local attacker with high privileges to disclose sensitive information from the underlying operating system. Exploitation requires certain preconditions outside the attacker's control. The vulnerability does not affect confidentiality, integrity, or availability beyond information disclosure. No known exploits are reported in the wild. Affected versions include all releases up to and including 3.4.1.0.