CVE Vulnerability Catalog

HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions.

Under certain circumstances on affected platforms running Arista EOS with gRPC Network Packet Sampling Interface (gNPSI) enabled, an unauthenticated gNPSI client can craft a malicious request to allow arbitrary code execution, granting an attacker full administrative control over the compromised switch.

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected.

Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read webhook secrets and service URLs. Attackers can retrieve stored credentials and register malicious webhooks to intercept pipeline events or suppress alerting by deleting existing configurations.

Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke CreateHttpListener and receive a signed JWT token. Attackers can use the obtained token to authenticate against the entire operator API and access grunts, credentials, binaries, events, and the operator roster.

Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrators to reset and read API keys of non-administrator users in other organizations. Attackers with admin privileges in one organization can supply arbitrary user IDs to generate valid API keys for users in different organizations, enabling account takeover across tenant boundaries.

An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_helper.exe component.

A vulnerability was found in Ruijie RG-EW3000GX EW_3.0(1)B11P380 within the user_list_note module in the file /etc/rg_config/admin. Manipulation of the Name argument leads to OS command injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashboard user management page. A stored XSS payload saved in this field executed in an administrator's browser when they viewed the affected user.

A vulnerability in the internal configuration of the Apache JServ Protocol (AJP) connector for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to impersonate a peer device. The issue is due to incorrect initialization of encryption parameters for the AJP connector at boot time. A successful exploit could allow the attacker to execute commands as root and gain full control over the FMC REST APIs, but only if the sftunnel connection between FMC and FTD is down.

Cisco conducted an internal security review that resulted in a software hardening release addressing multiple internally discovered vulnerabilities in Cisco Secure Adaptive Security Appliance Software, Cisco Secure Firewall Threat Defense Software, and Cisco Secure Firewall Management Center Software. The vulnerabilities tracked by CVE-2026-20331 relate to failure of protection mechanisms (CWE-693).

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. The attacker must have at least low-privileged administrative credentials. The issue is due to insecure deserialization of a user-supplied Java byte stream; successful exploitation could allow code execution and privilege escalation to root, and in single-node deployments could cause the ISE node to become unavailable (DoS).

A vulnerability in the REST API of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).

A vulnerability in the diagnostic tools of Cisco ISE and ISE-PIC could allow an authenticated, remote attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. The attacker must have valid administrative credentials. The issue is due to improper validation of user-supplied input; successful exploitation could allow arbitrary code execution, and in single-node deployments could cause the ISE node to become unavailable (DoS).

Cisco conducted an internal security review that resulted in a software hardening release addressing multiple internally discovered vulnerabilities in Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). The vulnerabilities tracked by CVE-2026-20234 relate to insufficiently protected credentials (CWE-522).

A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380 within the cc_set function of the file unifyframe-sgi.elf in the configChange component. Manipulation of the data.url argument leads to OS command injection. The attack may be performed remotely, and the exploit has been publicly disclosed.

A multi-stage trust-boundary violation in Sentry Seer allows unauthenticated attacker-controlled telemetry to become code executed by an agent in a privileged automation environment. An external attacker can submit fabricated Sentry events without access to the victim's Sentry account, source repository, or infrastructure.

Dell ObjectScale, versions prior to 4.4.0.0, contains a Deserialization of Untrusted Data vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote code execution.

LMDeploy implements an RPC server (AsyncRPCServer in zmq_rpc.py) whose call_and_response() function deserializes received messages using pickles.loads() without any sanitization. This allows remote code execution through the RPC server. The vulnerability exists from version 0.9.1 up to 0.10.2, where it is patched.

@fastify/proxy-addr versions 3.0.0 through 5.1.0 accept without error a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix (e.g. ::ffff:10.0.0.0/8 instead of ::ffff:10.0.0.0/104), causing every IPv4 address on the internet to be trusted. As a result, an unauthenticated client can supply an arbitrary X-Forwarded-For header and control the address the application reads. The issue is fixed in version 5.1.1.