# Vulnerabilities published in 2026


- [CVE-2026-76746](https://insights.sbomify.com/CVE-2026-76746/): Unauthenticated Adjacent Buffer Overflow Vulnerability Leading to Information Disclosure in AOS-S (critical 9.3)
- [CVE-2026-76745](https://insights.sbomify.com/CVE-2026-76745/): Unauthenticated Adjacent Memory Corruption Vulnerabilities Leading to Remote Code Execution in AOS-S (critical 9.6)
- [CVE-2026-76744](https://insights.sbomify.com/CVE-2026-76744/): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-S (critical 9.8)
- [CVE-2026-76743](https://insights.sbomify.com/CVE-2026-76743/): Authentication Bypass Vulnerability in the Management Interface of AOS-S (critical 9.8)
- [CVE-2026-76742](https://insights.sbomify.com/CVE-2026-76742/): Authentication Bypass in the Web Management Interface of AOS-S (critical 9.8)
- [CVE-2026-76741](https://insights.sbomify.com/CVE-2026-76741/): Authenticated Buffer Overflow Vulnerabilities lead to Denial-of-Service in AOS-S (medium 6.5)
- [CVE-2026-76740](https://insights.sbomify.com/CVE-2026-76740/): Command injection in HPE Compute Scale-up Server 3200 platform (high 7.2)
- [CVE-2026-7674](https://insights.sbomify.com/CVE-2026-7674/): Shenzhen Libituo Technology LBT-T300-HW1 Web Management start_single_service buffer overflow (high 8.7)
- [CVE-2026-76739](https://insights.sbomify.com/CVE-2026-76739/): HPE Compute Scale-up Server 3200 and 3250 platforms and Superdome Flex server, Remote RMC file modification (medium 4.3)
- [CVE-2026-76738](https://insights.sbomify.com/CVE-2026-76738/): Authenticated Buffer Overflow Vulnerability in the API Endpoint of HPE Networking Instant On Causes Denial-of-Service (low 2.7)
- [CVE-2026-76737](https://insights.sbomify.com/CVE-2026-76737/): Authenticated Local Path Traversal Vulnerability Leads to Denial-of-Service in HPE Networking Instant On (low 3.0)
- [CVE-2026-76736](https://insights.sbomify.com/CVE-2026-76736/): Authenticated Local Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking Instant On (low 3.3)
- [CVE-2026-76735](https://insights.sbomify.com/CVE-2026-76735/): Authenticated Local Sensitive Information Disclosure in HPE Networking Instant On (medium 4.1)
- [CVE-2026-76734](https://insights.sbomify.com/CVE-2026-76734/): Unauthenticated Memory Corruption Vulnerability leads to Denial-of-Service in HPE Networking Instant On (medium 4.8)
- [CVE-2026-76733](https://insights.sbomify.com/CVE-2026-76733/): Authenticated Denial-of-Service Vulnerability in HPE Networking Instant On API Endpoint (medium 4.9)
- [CVE-2026-76732](https://insights.sbomify.com/CVE-2026-76732/): Authenticated Local Privilege Escalation Vulnerability in a Daemon of HPE Networking Instant ON (medium 6.4)
- [CVE-2026-76731](https://insights.sbomify.com/CVE-2026-76731/): Authentication Bypass in the Captive Portal of HPE Networking Instant On (medium 6.5)
- [CVE-2026-76730](https://insights.sbomify.com/CVE-2026-76730/): Improper PAPI Packet handling leads to unauthorized access in HPE Networking Instant ON APs (medium 6.5)
- [CVE-2026-7673](https://insights.sbomify.com/CVE-2026-7673/): crmeb_java Admin Upload UploadServiceImpl.java unrestricted upload (medium 5.1)
- [CVE-2026-76729](https://insights.sbomify.com/CVE-2026-76729/): Authenticated Format String Vulnerability allows Memory Corruption in HPE Networking Instant ON API Endpoint (medium 6.6)
- [CVE-2026-76728](https://insights.sbomify.com/CVE-2026-76728/): Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs (high 7.2)
- [CVE-2026-76727](https://insights.sbomify.com/CVE-2026-76727/): Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON (high 7.2)
- [CVE-2026-76726](https://insights.sbomify.com/CVE-2026-76726/): Authentication Bypass Leading to Unauthorized Network Access in HPE Networking Instant ON API Endpoint (high 8.1)
- [CVE-2026-76725](https://insights.sbomify.com/CVE-2026-76725/): Authentication Bypass in a Management Protocol of HPE Networking Instant ON APs (critical 9.6)
- [CVE-2026-76724](https://insights.sbomify.com/CVE-2026-76724/): Command injection in Instant ON (critical 9.6)
- [CVE-2026-76723](https://insights.sbomify.com/CVE-2026-76723/): Unauthenticated Adjacent Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking Instant ON APS (critical 9.6)
- [CVE-2026-76722](https://insights.sbomify.com/CVE-2026-76722/): Memory corruption in Instant ON (critical 9.8)
- [CVE-2026-76721](https://insights.sbomify.com/CVE-2026-76721/): Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in HPE Networking Instant ON APs (critical 9.8)
- [CVE-2026-76720](https://insights.sbomify.com/CVE-2026-76720/): HPE OneView - URL Redirect vulnerability (medium 4.3)
- [CVE-2026-7672](https://insights.sbomify.com/CVE-2026-7672/): youlaitech youlai-boot Users Endpoint UserController.java getUserList sql injection (medium 5.3)
- [CVE-2026-76719](https://insights.sbomify.com/CVE-2026-76719/): HPE OneView - Cross-site scripting vulnerability (high 8.2)
- [CVE-2026-76718](https://insights.sbomify.com/CVE-2026-76718/): HPE OneView - Cross-site scripting vulnerability (high 8.2)
- [CVE-2026-76717](https://insights.sbomify.com/CVE-2026-76717/): Information disclosure in ALE (medium 5.3)
- [CVE-2026-76716](https://insights.sbomify.com/CVE-2026-76716/): Denial of service in ALE (medium 5.3)
- [CVE-2026-76715](https://insights.sbomify.com/CVE-2026-76715/): Other in ALE (high 7.1)
- [CVE-2026-76714](https://insights.sbomify.com/CVE-2026-76714/): Command injection in ALE (high 7.2)
- [CVE-2026-76713](https://insights.sbomify.com/CVE-2026-76713/): Authenticated Remote File System Access Vulnerability in HPE Networking Analytics and Location Engine (ALE) (high 7.2)
- [CVE-2026-76712](https://insights.sbomify.com/CVE-2026-76712/): Information disclosure in ALE (high 7.3)
- [CVE-2026-76711](https://insights.sbomify.com/CVE-2026-76711/): Unauthenticated Remote Data Injection Vulnerability in HPE Networking Analytics and Location Engine (ALE) (high 7.5)
- [CVE-2026-76710](https://insights.sbomify.com/CVE-2026-76710/): Information disclosure in ALE (high 7.5)
- [CVE-2026-7671](https://insights.sbomify.com/CVE-2026-7671/): CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication (medium 6.3)
- [CVE-2026-76709](https://insights.sbomify.com/CVE-2026-76709/): Unauthenticated Remote Arbitrary File Write Vulnerability in HPE Networking Analytics and Location Engine (ALE) (critical 9.8)
- [CVE-2026-76708](https://insights.sbomify.com/CVE-2026-76708/): Unauthenticated Remote Unauthorized Access Vulnerability in HPE Networking Analytics and Location Engine (ALE) (critical 9.8)
- [CVE-2026-76707](https://insights.sbomify.com/CVE-2026-76707/): Unauthenticated Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways (medium 4.3)
- [CVE-2026-76706](https://insights.sbomify.com/CVE-2026-76706/): Unauthenticated Information Disclosure in EdgeConnect SD-WAN Orchestrator API allows exposure of sensitive data (medium 5.3)
- [CVE-2026-76705](https://insights.sbomify.com/CVE-2026-76705/): Memory corruption in EdgeConnect SD-WAN Gateways (medium 5.5)
- [CVE-2026-76704](https://insights.sbomify.com/CVE-2026-76704/): Cross-site scripting in EdgeConnect SD-WAN Gateways (medium 5.5)
- [CVE-2026-76703](https://insights.sbomify.com/CVE-2026-76703/): Memory corruption in EdgeConnect SD-WAN Gateways (medium 5.5)
- [CVE-2026-76702](https://insights.sbomify.com/CVE-2026-76702/): Authenticated Local Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (medium 5.8)
- [CVE-2026-76701](https://insights.sbomify.com/CVE-2026-76701/): Unauthenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways (medium 5.9)
- [CVE-2026-76700](https://insights.sbomify.com/CVE-2026-76700/): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (medium 5.9)
- [CVE-2026-7670](https://insights.sbomify.com/CVE-2026-7670/): Jinher OA UserSel.aspx sql injection (medium 6.9)
- [CVE-2026-76699](https://insights.sbomify.com/CVE-2026-76699/): Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways (medium 6.4)
- [CVE-2026-76698](https://insights.sbomify.com/CVE-2026-76698/): Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways (medium 6.5)
- [CVE-2026-76697](https://insights.sbomify.com/CVE-2026-76697/): Authenticated Information Disclosure in HPE Networking EdgeConnect Enterprise Web-Based Management Interface (medium 6.5)
- [CVE-2026-76696](https://insights.sbomify.com/CVE-2026-76696/): Denial of service in EdgeConnect SD-WAN Gateways (medium 6.5)
- [CVE-2026-76695](https://insights.sbomify.com/CVE-2026-76695/): Unauthenticated Buffer Overflow Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (medium 6.5)
- [CVE-2026-76694](https://insights.sbomify.com/CVE-2026-76694/): Privilege escalation in EdgeConnect SD-WAN Gateways (medium 6.6)
- [CVE-2026-76693](https://insights.sbomify.com/CVE-2026-76693/): Unauthenticated Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (high 7.0)
- [CVE-2026-76692](https://insights.sbomify.com/CVE-2026-76692/): Information disclosure in EdgeConnect SD-WAN Gateways (high 7.1)
- [CVE-2026-76691](https://insights.sbomify.com/CVE-2026-76691/): Memory corruption in EdgeConnect SD-WAN Gateways (high 7.2)
- [CVE-2026-76690](https://insights.sbomify.com/CVE-2026-76690/): Authenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (high 7.2)
- [CVE-2026-7669](https://insights.sbomify.com/CVE-2026-7669/): sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection (medium 6.3)
- [CVE-2026-76689](https://insights.sbomify.com/CVE-2026-76689/): Memory corruption in EdgeConnect SD-WAN Gateways (high 7.2)
- [CVE-2026-76688](https://insights.sbomify.com/CVE-2026-76688/): Authentication Bypass Vulnerabilities in the Web-Based Management Interface of EdgeConnect SD-WAN Orchestrator (high 7.5)
- [CVE-2026-76687](https://insights.sbomify.com/CVE-2026-76687/): Authenticated Arbitrary File Write Leading to Remote Code Execution in EdgeConnect SD-WAN Orchestrator (high 7.5)
- [CVE-2026-76686](https://insights.sbomify.com/CVE-2026-76686/): Denial of service in EdgeConnect SD-WAN Gateways (high 7.5)
- [CVE-2026-76685](https://insights.sbomify.com/CVE-2026-76685/): Integer overflow in EdgeConnect SD-WAN Gateways (high 8.1)
- [CVE-2026-76684](https://insights.sbomify.com/CVE-2026-76684/): Authentication Bypass Vulnerabilities in HPE Networking EdgeConnect SD-WAN Orchestrator API (high 8.1)
- [CVE-2026-76683](https://insights.sbomify.com/CVE-2026-76683/): Memory corruption in EdgeConnect SD-WAN Gateways (high 8.1)
- [CVE-2026-76682](https://insights.sbomify.com/CVE-2026-76682/): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (high 8.2)
- [CVE-2026-76681](https://insights.sbomify.com/CVE-2026-76681/): Authenticated Information Disclosure Vulnerability in HPE Networking EdgeConnect SD-WAN Orchestrator API (high 8.5)
- [CVE-2026-76680](https://insights.sbomify.com/CVE-2026-76680/): Server-side request forgery in EdgeConnect SD-WAN Gateways (high 8.5)
- [CVE-2026-7668](https://insights.sbomify.com/CVE-2026-7668/): MikroTik RouterOS SCEP Endpoint scep.p ASN1_STRING_data out-of-bounds (medium 6.9)
- [CVE-2026-76679](https://insights.sbomify.com/CVE-2026-76679/): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (high 8.6)
- [CVE-2026-76678](https://insights.sbomify.com/CVE-2026-76678/): Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways (high 8.8)
- [CVE-2026-76677](https://insights.sbomify.com/CVE-2026-76677/): Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways (high 8.8)
- [CVE-2026-76676](https://insights.sbomify.com/CVE-2026-76676/): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in EdgeConnect SD-WAN Gateways (high 8.8)
- [CVE-2026-76675](https://insights.sbomify.com/CVE-2026-76675/): Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways (critical 9.1)
- [CVE-2026-76674](https://insights.sbomify.com/CVE-2026-76674/): Memory corruption in EdgeConnect SD-WAN Gateways (critical 9.8)
- [CVE-2026-76673](https://insights.sbomify.com/CVE-2026-76673/): Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator (critical 9.8)
- [CVE-2026-76672](https://insights.sbomify.com/CVE-2026-76672/): Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator (critical 9.9)
- [CVE-2026-76670](https://insights.sbomify.com/CVE-2026-76670/): Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator (critical 9.9)
- [CVE-2026-7667](https://insights.sbomify.com/CVE-2026-7667/): Path Traversal Vulnerability in API Request Component Content-Disposition Header Processing (high 8.8)
- [CVE-2026-76669](https://insights.sbomify.com/CVE-2026-76669/): Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator (critical 9.9)
- [CVE-2026-76668](https://insights.sbomify.com/CVE-2026-76668/): HPE NonStop Kernel - Access to unmapped or privileged data (medium 6.3)
- [CVE-2026-76667](https://insights.sbomify.com/CVE-2026-76667/): HPE NonStop EXPAND - Out-of-Bounds memory read vulnerability (medium 5.7)
- [CVE-2026-76666](https://insights.sbomify.com/CVE-2026-76666/): HPE NonStop EXPAND - Out-of-Bounds memory read (medium 4.7)
- [CVE-2026-76665](https://insights.sbomify.com/CVE-2026-76665/): HPE NonStop EXPAND - Buffer Overflow vulnerability (high 7.1)
- [CVE-2026-76664](https://insights.sbomify.com/CVE-2026-76664/): HPE NonStop EXPAND - Out-of-Bounds memory read/write (medium 6.4)
- [CVE-2026-76663](https://insights.sbomify.com/CVE-2026-76663/): HPE NonStop TELSERV - Memory corruption vulnerability (high 7.5)
- [CVE-2026-76662](https://insights.sbomify.com/CVE-2026-76662/): HPE NonStop TELSERV - Memory corruption vulnerability (medium 5.9)
- [CVE-2026-76661](https://insights.sbomify.com/CVE-2026-76661/): HPE NonStop QIOMON - Memory corruption vulnerability (high 7.6)
- [CVE-2026-76660](https://insights.sbomify.com/CVE-2026-76660/): HPE NonStop CIPSAM - Memory corruption vulnerability (high 8.7)
- [CVE-2026-7666](https://insights.sbomify.com/CVE-2026-7666/): Potential unencrypted email transmission via STARTTLS in the SMTP backend (low 2.3)
- [CVE-2026-76659](https://insights.sbomify.com/CVE-2026-76659/): HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability (high 7.5)
- [CVE-2026-76658](https://insights.sbomify.com/CVE-2026-76658/): Unauthenticated Remote Code Execution in HPE Networking Fabric Composer SSH Daemon (critical 10.0)
- [CVE-2026-76657](https://insights.sbomify.com/CVE-2026-76657/): Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access (critical 10.0)
- [CVE-2026-76656](https://insights.sbomify.com/CVE-2026-76656/): HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability (medium 5.3)
- [CVE-2026-76655](https://insights.sbomify.com/CVE-2026-76655/): HPE NonStop SNMP Trap Multiplexer - Buffer Overflow vulnerability (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/375/