Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,769exploited flaws on CISA’s list

30added in the last 30 days

459new WordPress flaws this week

394,717entries in the database

394,717 results · page 422 of 7895

Sep 29, 2026The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.CVE-2026-71379 · Other software · Toptech Systems · reported by ics-cert@hq.dhs.govCritical 10
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request.
Product
TMS7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Sep 29, 2026The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication.CVE-2026-71302 · Other software · Toptech Systems · reported by ics-cert@hq.dhs.govHigh 7.5
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover.
Product
TMS7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Sep 29, 2026An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user'CVE-2026-71189 · Other software · Toptech Systems · reported by ics-cert@hq.dhs.govMedium 4.8
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
Product
TMS7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Sep 29, 2026The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web servCVE-2026-70356 · Other software · Toptech Systems · reported by ics-cert@hq.dhs.govCritical 9.4
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server.
Product
TMS7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Sep 29, 2026The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.CVE-2026-69662 · Other software · Toptech Systems · reported by ics-cert@hq.dhs.govLow 2.1
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions.
Product
TMS7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Sep 29, 2026The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.CVE-2026-68954 · Other software · Toptech Systems · reported by ics-cert@hq.dhs.govHigh 8.5
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability.
Product
TMS7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Sep 29, 2026The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injeCVE-2026-68068 · Other software · Toptech Systems · reported by ics-cert@hq.dhs.govHigh 8.5
The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability.
Product
TMS7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Sep 29, 2026The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.CVE-2026-63713 · Other software · Toptech Systems · reported by ics-cert@hq.dhs.govHigh 8.5
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability.
Product
TMS7
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com cisa.gov
Sep 29, 2026A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7.CVE-2026-102771 · Other software · Naichen · reported by VulDBLow 2
A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templatePut of the file cmf-api/src/admin/controller/MailController.php of the component Email Template. The manipulation leads to improper neutralization of special elements used in a template engine. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Product
ThinkCMF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vuldb.com
Sep 29, 2026A vulnerability was identified in Freedesktop Poppler up to 26.08.0.CVE-2026-102621 · Other software · Freedesktop · reported by VulDBLow 1.9
A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/SplashClip.cc. Such manipulation leads to integer overflow. The attack can only be performed from a local environment. The exploit is publicly available and might be used. Upgrading to version 26.09.0 is able to address this issue. The name of the patch is 323c91036d99926a8b90dc14329f7b40aece22f8. It is recommended to upgrade the affected component.
Product
Poppler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com gitlab.freedesktop.org
Sep 29, 2026The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code.CVE-2026-96587 · Other software · Viidure · reported by ics-cert@hq.dhs.govCritical 10
The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.
Product
Dashcam Android Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com viidure.app
Sep 29, 2026A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.CVE-2026-94952 · Other software · reported by MITRECritical 9.8
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-forwarding configuration handler) and is triggered by the ip_subnet and fw_ip request parameters during the rule-addition flow.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Sep 29, 2026The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objeCVE-2026-94204 · Other software · Viidure · reported by ics-cert@hq.dhs.govHigh 8.7
The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.
Product
Dashcam Android Application
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com viidure.app
Sep 29, 2026Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots.CVE-2026-93853 · Other software · EnterpriseDB · reported by 20be33e2-bf35-4d13-8fad-18bd2f3e3659High 7.2
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the backup.info file and passes them to the cloud provider's delete API using Barman's own credentials, without verifying that the snapshots belong to that backup. An attacker who can overwrite backup.info but lacks snapshot delete permissions can substitute the identifiers of other snapshots, causing Barman to delete any snapshot its cloud identity can reach on AWS, Microsoft Azure, or Google Cloud. Exploitation requires a deployment where the principal that writes the backup catalog is separate from the identity Barman uses to delete snapshots. Barman versions from 3.4.0 (Google Cloud), 3.6.0 (Azure), and 3.7.0 (AWS) up to and including 3.20.0 are affected. The issue is fixed in Barman 3.20.1.
Product
Barman
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record enterprisedb.com
Sep 29, 2026An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library CVE-2026-81842 · Other software · Grafana · reported by security@grafana.comMedium 4.3
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.
Product
Grafana Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record grafana.com
Sep 29, 2026Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data.CVE-2026-81841 · Other software · Grafana · reported by security@grafana.comMedium 5.3
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.
Product
Grafana Enterprise
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record grafana.com
Sep 29, 2026virtualenv is a tool for creating isolated virtual python environments.CVE-2026-102938 · Other software · pypa · reported by GitHubMedium 5.8
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.
Product
virtualenv
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 29, 2026virtualenv is a tool for creating isolated virtual python environments.CVE-2026-102937 · Other software · pypa · reported by GitHubHigh 7.3
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12.
Product
virtualenv
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 29, 2026virtualenv is a tool for creating isolated virtual python environments.CVE-2026-102930 · Other software · pypa · reported by GitHubHigh 7.7
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12.
Product
virtualenv
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 29, 2026virtualenv is a tool for creating isolated virtual python environments.CVE-2026-102925 · Other software · pypa · reported by GitHubHigh 7.8
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13.
Product
virtualenv
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 29, 2026JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture.CVE-2026-102904 · Other software · jupyterlab · reported by GitHubMedium 5.4
JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall names to PyPIExtensionManager.uninstall and python -m pip uninstall without rejecting option-like values. The security impact requires that the PyPI Extension Manager is enabled, the account can call the extension API, and kernels and terminals are disabled or delegated to remote hosts; otherwise the user can already read files and make outbound requests directly. An authenticated user with extension API access can supply a pip requirements option to make the server read a local file or fetch an internal URL, and reflected parse errors can return the first unparsable line or response content. A pip log option can also create or corrupt a chosen path with pip-generated log text, but the requester cannot select an arbitrary disclosed line or arbitrary file content, and the injection does not add code execution or availability impact beyond ordinary package removal. This
Product
jupyterlab
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 29, 2026A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0.CVE-2026-102620 · Other software · Freedesktop · reported by VulDBLow 1.9
A vulnerability was determined in Freedesktop Poppler 26.06.0/26.07.0/26.08.0. This impacts the function FoFiTrueType::cvtSfnts of the file fofi/FoFiTrueType.cc. This manipulation causes integer overflow. The attack can only be executed locally. The exploit has been publicly disclosed and may be utilized. Patch name: 245d3c6823377755f2c1d5fdddd010279c6ed94d. It is suggested to install a patch to address this issue.
Product
Poppler
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com gitlab.freedesktop.org
Sep 29, 2026iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worCVE-2026-102253 · Other software · esnet · reported by VulnCheckHigh 8.7
iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.
Product
iperf3
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 29, 2026In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payCVE-2026-96274 · Other software · Baicells · reported by ics-cert@hq.dhs.govHigh 8.3
In Baicells Nova 430H, an unauthenticated device within radio range can send a malformed uplink message during connection setup that contains an invalid NAS payload. Because the eNodeB does not properly validate this payload, it forwards the message to the core network, which can trigger a shutdown of the signaling association for the cell. This results in a temporary service disruption until the eNodeB and core network re-establish connectivity.
Product
Nova 430H eNodeB (model pBS3101SH)
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cisa.gov
Sep 29, 2026A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030.CVE-2026-94953 · Other software · reported by MITREHigh 8.8
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formAjaxSet using the topicurl=setting/setWiFiRepeaterConfig branch and the ApCliWEPKey field.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com
Sep 29, 2026metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTCVE-2026-79538 · Other software · reported by MITRECritical 9.8
metatool-ai MetaMCP up to and including 2.4.22 is vulnerable to Code Execution in the internal MCP inspector proxy endpoint GET /mcp-proxy/server/stdio (createTransport, STDIO branch, routers/mcp-proxy/server.ts).
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com traceforce.ai
Sep 29, 2026metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch.CVE-2026-79537 · Other software · reported by MITRECritical 9.1
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the per-endpoint authorization middleware validates only the URL endpoint's owner, never the session. An attacker who supplies another tenant's session id " obtained without authentication from GET /metamcp/health/sessions, which discloses active session IDs and namespace UUIDs " can list and execute the victim tenant's private MCP tools and exfiltrate their data using the victim's forwarded credentials.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com traceforce.ai
Sep 29, 2026bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component.CVE-2026-79536 · Other software · reported by MITRECritical 9.1
bytebase dbhub v1.2.0 was discovered to contain a SQL injection vulnerability in the /utils/sql-parser.ts component. This vulnerability allows attackers to access sensitive databse information via a crafted SQL statement.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record traceforce.ai
Sep 29, 2026mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection.CVE-2026-79535 · Other software · reported by MITREMedium 6.3
mbailey VoiceMode <= 8.10.1 is vulnerable to OS Command Injection. The update_config MCP tool (and the "voicemode config set" CLI) writes a caller-supplied value into ~/.voicemode/voicemode.env without shell-safe escaping.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 29, 2026mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helperCVE-2026-79534 · Other software · reported by MITREMedium 5.9
mark3labs mcp-filesystem-server v0.11.1 is vulnerable to Directory Traversal due to an improper link resolution in validatePath (filesystemserver/handler/helper.go). When filepath.EvalSymlinks returns os.IsNotExist for a dangling symlink, the fallback validates only the parent directory and returns the unresolved path, so write_file (and modify_file, copy_file, move_file, create_directory) follows a pre-existing dangling symlink located inside an allowed directory and creates a file outside the configured allowed directories.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record traceforce.ai
Sep 29, 2026Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle accessCVE-2026-79417 · Other software · reported by MITREMedium 5.3
Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in IRP_MJ_CREATE and send a crafted IOCTL 0x9C4024A8 request, causing denial-of-service.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record connorjaydunn.github.io
Sep 29, 2026An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpointCVE-2026-79403 · Other software · reported by MITREHigh 8.4
An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Sep 29, 2026KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API.CVE-2026-79348 · Other software · reported by MITREMedium 4.3
KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API. The endpoint GET /api/reservations/:id in packages/server applies the authenticate middleware but performs no ownership or role check, and the getReservation handler in packages/server/src/controllers/reservation.controller.ts returns the record retrieved by the client-supplied identifier without comparing reservation.customerId to the authenticated principal
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Sep 29, 2026A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privilegeCVE-2026-76738 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comLow 2.7
A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which recovers without manual intervention.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On.CVE-2026-76737 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comLow 3
An authenticated path traversal vulnerability exists in the command line interface of HPE Networking Instant On. Successful exploitation could allow an attacker with administrative access to modify a limited set of files on the underlying operating system and to interrupt the normal operation of the affected service.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On.CVE-2026-76736 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comLow 3.3
A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow a low-privilege authenticated local attacker to interrupt the normal operation of the affected service.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On.CVE-2026-76735 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.1
A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On. Successful exploitation could allow an authenticated local attacker with high privileges to retrieve information which could be used to potentially gain further access to network services supported by HPE Networking Instant On, only if certain preconditions outside of the attacker's control are met.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of sCVE-2026-76734 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.8
A memory corruption vulnerability in the affected interface of HPE Networking Instant On could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service and to access some limited information within the affected component.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileCVE-2026-76733 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 4.9
A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with administrative privileges to cause a denial of service. Successful exploitation could allow an attacker to interrupt the normal operation of the affected service, which resumes without manual intervention.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON.CVE-2026-76732 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.4
A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation of this vulnerability could allow a local attacker to achieve arbitrary code execution with root privileges if certain preconditions are met outside of the attacker's control.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing CVE-2026-76731 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
An authentication bypass vulnerability in the captive portal of HPE Networking Instant On could allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain limited access to some data and to make limited changes within the affected component.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to cirCVE-2026-76730 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.5
An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to circumvent certain existing authentication mechanisms and send unauthorized network traffic to the target device.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause meCVE-2026-76729 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comMedium 6.6
A format string vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to cause memory corruption with a modified input. Successful exploitation could allow an attacker to provoke a denial-of-service condition or remote code execution in the affected system function.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side CVE-2026-76728 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high priviCVE-2026-76727 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.2
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access CVE-2026-76726 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.1
An authentication bypass vulnerability in the API endpoint of HPE Networking Instant ON could allow an unauthenticated remote attacker to bypass network access controls if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain unauthorized access to restricted networks.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvenCVE-2026-76725 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
A vulnerability has been identified in a management protocol of HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could result in a complete bypass of security restrictions, potentially leading to remote code execution with elevated privileges.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform cCVE-2026-76724 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achievCVE-2026-76723 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.6
Buffer overflow vulnerabilities exist in the affected interface of HPE Networking Instant ON APS that could allow an unauthenticated adjacent attacker to achieve remote code execution. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com
Sep 29, 2026Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker CVE-2026-76722 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
Uncontrolled Format string vulnerabilities exist in the affected interface of HPE Networking Instant ON APs that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation could result in a Denial-of-service or potential remote code execution.
Product
Instant ON
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.hpe.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.