Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,494 results · page 2 of 190
Oct 22, 2026A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow.CVE-2026-79888 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.1
A vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system, leading to complete system compromise.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution.CVE-2026-79887 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.1
A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8.CVE-2026-79886 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.2
An unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8. Successful exploitation could allow an unauthenticated remote attacker to disrupt the availability of the affected service on the controller, with a limited impact to its integrity.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8.CVE-2026-79885 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.2
An unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to make limited modifications to files on the affected system and to disrupt the availability of the affected service.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and aCVE-2026-79884 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.2
A vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information. Successful exploitation could allow an attacker to gain access to some data in a cleartext format possibly exposing other network infrastructure to further compromise.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information.CVE-2026-79883 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.3
A buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, and to interrupt the normal operation of the affected service.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sendiCVE-2026-79882 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.3
There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentCVE-2026-79881 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.3
An authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system leading to complete system compromise.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgerCVE-2026-79880 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.7
A vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker.CVE-2026-79879 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adCVE-2026-79878 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code onCVE-2026-79877 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system leading to complete system compromise.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive inCVE-2026-79876 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.3
A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing autheCVE-2026-79875 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.3
A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls.CVE-2026-79874 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.3
An authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication contCVE-2026-79873 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.3
Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data on affected devices.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated CVE-2026-79872 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.4
A buffer overflow vulnerability exists in the underlying operating system of AOS that could lead to unauthenticated remote code execution by an unauthenticated remote attacker. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive infoCVE-2026-79871 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
A sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication contCVE-2026-79870 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
An authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, access or manipulate sensitive data, and disrupt network operations.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authenticationCVE-2026-79869 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication CVE-2026-79868 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data, leading to complete compromise of the affected system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication CVE-2026-79867 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system leading to complete system compromise.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8.CVE-2026-79866 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could allow an unauthenticated adjacent attacker to read, modify, and delete files on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution.CVE-2026-79865 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection.CVE-2026-79864 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sendiCVE-2026-79863 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sendiCVE-2026-79862 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets.CVE-2026-79861 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted paCVE-2026-79860 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution.CVE-2026-79859 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8.CVE-2026-79858 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote coCVE-2026-79857 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication cCVE-2026-79856 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls.CVE-2026-79855 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
An authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation allows an attacker to gain administrative privileges leading to complete compromise of the AOS-8 host.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance.CVE-2026-79854 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive informatCVE-2026-79853 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS insCVE-2026-79852 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
A vulnerability in the web-based management interface of AOS could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution.CVE-2026-79851 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Buffer overflow vulnerabilities exist in the affected interface of AOS-10 that could lead to unauthenticated remote code execution. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the underlying operating system, leading to complete system compromise.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary cCVE-2026-79850 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to bypass existing authentication controls and run arbitrary commands on the underlying host. Successful exploitation could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 insCVE-2026-79849 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 insCVE-2026-79848 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to CVE-2026-79847 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Buffer overflow vulnerabilities in the affected interface of AOS-10 could lead to unauthenticated remote code execution by sending specially crafted packets to the affected interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary code as a privileged user on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the CVE-2026-79846 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlCVE-2026-79844 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 10
Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
- Product
- ArubaOS (AOS)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026A flaw was found in GNU patch.CVE-2026-115207 · Other software · Red Hat · reported by Red HatMedium 5.5
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 22, 2026A flaw was found in Goose.CVE-2026-111079 · Other software · Red Hat · reported by Red HatHigh 7.4
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
- Product
- Red Hat Enterprise Linux 10
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaccess.redhat.combugzilla.redhat.com
Oct 21, 2026In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API aCVE-2026-76308 · Other software · Splunk · reported by psirt@cisco.comMedium 6.5
In Splunk SOAR versions below 8.7.0, an authenticated user could change the Enterprise Security edition through the Representational State Transfer (REST) API and cause Splunk SOAR to apply the license change. The vulnerability is possible because Splunk SOAR authenticates requests to manage the Enterprise Security edition but does not authorize the caller before it applies the license change. For more information see Using the REST API reference for Splunk SOAR (On-premises) (https://help.splunk.com/en/splunk-soar/soar-on-premises/rest-api-reference/8.7.0/using-the-splunk-soar-rest-api/using-the-rest-api-reference-for-splunk-soar-on-premises), Obtain and configure a Splunk SOAR (On-premises) license (https://help.splunk.com/en/splunk-soar/soar-on-premises/administer-soar-on-premises/8.7.0/configure-your-companys-settings-in-splunk-soar-on-premises/obtain-and-configure-a-splunk-soar-on-premises-license), and Integration of Splunk SOAR with Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/administer/8.7/automation-with-playbooks/integration-of-splunk-soar-with-splunk-enterprise-security) in the Splunk documentation.
- Product
- Splunk SOAR
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.CVE-2026-76302 · Other software · Splunk · reported by psirt@cisco.comCritical 9.9
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76302 are related to improper neutralization and are grouped under the Common Weakness Enumeration (CWE) CWE-707.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.CVE-2026-76301 · Other software · Splunk · reported by psirt@cisco.comCritical 9.8
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76301 are related to protection mechanism failure and are grouped under the Common Weakness Enumeration (CWE) CWE-693.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review.CVE-2026-76300 · Other software · Splunk · reported by psirt@cisco.comHigh 8.8
As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76300 are related to improper control of a resource through its lifetime and are grouped under the Common Weakness Enumeration (CWE) CWE-664.
- Product
- Splunk Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.