# Vulnerabilities published in 2026


- [CVE-2026-73770](https://insights.sbomify.com/CVE-2026-73770/): Authenticated Arbitrary File Write Vulnerability Leading to Remote Code Execution in AOS-CX (high 7.3)
- [CVE-2026-7377](https://insights.sbomify.com/CVE-2026-7377/): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (high 8.7)
- [CVE-2026-73769](https://insights.sbomify.com/CVE-2026-73769/): Authenticated Remote Code Execution in CPPM Web Interface (high 7.2)
- [CVE-2026-73768](https://insights.sbomify.com/CVE-2026-73768/): Local Privilege Escalation in AOS-CX Command Line Interface (high 7.3)
- [CVE-2026-73767](https://insights.sbomify.com/CVE-2026-73767/): Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface (high 7.2)
- [CVE-2026-73766](https://insights.sbomify.com/CVE-2026-73766/): Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX (high 7.2)
- [CVE-2026-73765](https://insights.sbomify.com/CVE-2026-73765/): Authenticated Path Traversal Vulnerabilities Lead to Remote Code Execution in AOS-CX (high 7.2)
- [CVE-2026-73764](https://insights.sbomify.com/CVE-2026-73764/): Authentication Bypass Vulnerabilities Leading to Unauthorized Modification and Service Disruption in AOS-CX (high 7.1)
- [CVE-2026-73763](https://insights.sbomify.com/CVE-2026-73763/): Unauthenticated Remote Command Execution in Management Component (high 7.1)
- [CVE-2026-73762](https://insights.sbomify.com/CVE-2026-73762/): Authorization Bypass in the API Endpoint of AOS-CX Leads to Unauthorized Access (medium 6.6)
- [CVE-2026-73761](https://insights.sbomify.com/CVE-2026-73761/): Unauthenticated Out-of-Bounds Read Vulnerability leads to Information Disclosure in AOS-CX (medium 6.5)
- [CVE-2026-73760](https://insights.sbomify.com/CVE-2026-73760/): Authenticated Path Traversal Vulnerability Leads to Remote Unauthorized Access to Files in AOS-CX (medium 6.5)
- [CVE-2026-7376](https://insights.sbomify.com/CVE-2026-7376/): NULL Pointer Dereference in Wireshark (medium 5.5)
- [CVE-2026-73759](https://insights.sbomify.com/CVE-2026-73759/): Unauthenticated Denial-of-Service Vulnerabilities in AOS-CX (medium 6.5)
- [CVE-2026-73758](https://insights.sbomify.com/CVE-2026-73758/): Authenticated Privilege Escalation Vulnerability via Broken Access Control in AOS-CX (medium 6.5)
- [CVE-2026-73757](https://insights.sbomify.com/CVE-2026-73757/): Authenticated Server-Side Request Forgery (SSRF) Leading to Information Disclosure in AOS-CX (medium 6.4)
- [CVE-2026-73756](https://insights.sbomify.com/CVE-2026-73756/): Unauthenticated Sensitive Information Disclosure via Man-in-the-Middle in AOS-CX via API Endpoint (medium 5.9)
- [CVE-2026-73755](https://insights.sbomify.com/CVE-2026-73755/): Privilege Escalation via Unauthorized Access to Sensitive Session Information (medium 5.7)
- [CVE-2026-73754](https://insights.sbomify.com/CVE-2026-73754/): Authenticated Denial-of-Service Vulnerabilities in the Command Line Interface of AOS-CX (medium 5.3)
- [CVE-2026-73753](https://insights.sbomify.com/CVE-2026-73753/): Authenticated Remote Command Injection Vulnerabilities in AOS-CX Command Line Interface (high 8.8)
- [CVE-2026-73752](https://insights.sbomify.com/CVE-2026-73752/): Unauthenticated Arbitrary File Write Vulnerability Leads to Remote Code Execution in AOS-CX (high 8.8)
- [CVE-2026-73751](https://insights.sbomify.com/CVE-2026-73751/): Authenticated Remote Command Injection in AOS-CX Web-based Management Interface (high 8.8)
- [CVE-2026-73750](https://insights.sbomify.com/CVE-2026-73750/): Authenticated Buffer Overflow Vulnerabilities in AOS-CX API Endpoint Leads to Possible Code Execution (high 8.8)
- [CVE-2026-7375](https://insights.sbomify.com/CVE-2026-7375/): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (medium 5.5)
- [CVE-2026-73749](https://insights.sbomify.com/CVE-2026-73749/): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in AOS-CX (critical 9.8)
- [CVE-2026-73748](https://insights.sbomify.com/CVE-2026-73748/): Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer (low 2.2)
- [CVE-2026-73747](https://insights.sbomify.com/CVE-2026-73747/): Local Privilege Escalation Vulnerability in HPE Networking Fabric Composer (low 2.5)
- [CVE-2026-73746](https://insights.sbomify.com/CVE-2026-73746/): Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer API (low 3.1)
- [CVE-2026-73745](https://insights.sbomify.com/CVE-2026-73745/): Unauthenticated Limited Information Disclosure allows Data Exposure in the API of HPE Networking Fabric Composer (low 3.1)
- [CVE-2026-73744](https://insights.sbomify.com/CVE-2026-73744/): Authenticated Denial of Service Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface (low 3.5)
- [CVE-2026-73743](https://insights.sbomify.com/CVE-2026-73743/): Unauthenticated Information Disclosure Leading to Data Exposure in HPE Networking Fabric Composer (low 3.7)
- [CVE-2026-73742](https://insights.sbomify.com/CVE-2026-73742/): Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint (medium 4.3)
- [CVE-2026-73741](https://insights.sbomify.com/CVE-2026-73741/): Authenticated Limited File Read allows Data Exposure in HPE Networking Fabric Composer API (medium 4.3)
- [CVE-2026-73740](https://insights.sbomify.com/CVE-2026-73740/): Local Privilege Escalation in HPE Networking Fabric Composer (medium 4.4)
- [CVE-2026-7374](https://insights.sbomify.com/CVE-2026-7374/): Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability (critical 9.9)
- [CVE-2026-73739](https://insights.sbomify.com/CVE-2026-73739/): Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API (medium 4.4)
- [CVE-2026-73738](https://insights.sbomify.com/CVE-2026-73738/): Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer (medium 4.7)
- [CVE-2026-73737](https://insights.sbomify.com/CVE-2026-73737/): Unauthenticated Path Traversal in HPE Networking Fabric Composer API Endpoint Allows Unauthorized File Modification (medium 4.8)
- [CVE-2026-73736](https://insights.sbomify.com/CVE-2026-73736/): Unauthenticated Limited Information Disclosure leads to Data Exposure in HPE Networking Fabric Composer (medium 5.3)
- [CVE-2026-73735](https://insights.sbomify.com/CVE-2026-73735/): Authenticated Access Control Vulnerabilities allow Information Disclosure in HPE Networking Fabric Composer API (medium 5.4)
- [CVE-2026-73734](https://insights.sbomify.com/CVE-2026-73734/): Unauthenticated Open Redirect allows URL Manipulation in HPE Networking Fabric Composer Web Interface (medium 5.4)
- [CVE-2026-73733](https://insights.sbomify.com/CVE-2026-73733/): Authentication Bypasses in API allow Continued Authenticated Access in HPE Networking Fabric Composer (medium 5.4)
- [CVE-2026-73732](https://insights.sbomify.com/CVE-2026-73732/): Local Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer (medium 5.6)
- [CVE-2026-73731](https://insights.sbomify.com/CVE-2026-73731/): Cross-site scripting in Fabric Composer (medium 6.1)
- [CVE-2026-73730](https://insights.sbomify.com/CVE-2026-73730/): Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API (medium 6.5)
- [CVE-2026-7373](https://insights.sbomify.com/CVE-2026-7373/): Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading (high 8.5)
- [CVE-2026-73729](https://insights.sbomify.com/CVE-2026-73729/): Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer (medium 6.5)
- [CVE-2026-73728](https://insights.sbomify.com/CVE-2026-73728/): Authenticated Denial of Service Vulnerabilities in HPE Networking Fabric Composer API (medium 6.5)
- [CVE-2026-73727](https://insights.sbomify.com/CVE-2026-73727/): Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API (medium 6.5)
- [CVE-2026-73726](https://insights.sbomify.com/CVE-2026-73726/): Authentication Bypass in HPE Networking Fabric Composer allows Unauthorized Administrative Access (medium 6.8)
- [CVE-2026-73725](https://insights.sbomify.com/CVE-2026-73725/): Local Privilege Escalation leads to Arbitrary Code Execution in HPE Networking Fabric Composer (high 7.0)
- [CVE-2026-73724](https://insights.sbomify.com/CVE-2026-73724/): Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer (high 7.1)
- [CVE-2026-73723](https://insights.sbomify.com/CVE-2026-73723/): Privilege escalation in Fabric Composer (high 7.1)
- [CVE-2026-73722](https://insights.sbomify.com/CVE-2026-73722/): Authenticated Command Injection Vulnerabilities in HPE Networking Fabric Composer Web-Based Management Interface (high 7.2)
- [CVE-2026-73721](https://insights.sbomify.com/CVE-2026-73721/): Authenticated SQL Injection Vulnerabilities in HPE Networking Fabric Composer (high 7.2)
- [CVE-2026-73720](https://insights.sbomify.com/CVE-2026-73720/): Authenticated Insecure File Handling allows Remote Code Execution in HPE Networking Fabric Composer API (high 7.2)
- [CVE-2026-7372](https://insights.sbomify.com/CVE-2026-7372/): GeoVision GV-VMS V20 WebCam Server Login stack overflow vulnerability (critical 9.0)
- [CVE-2026-73719](https://insights.sbomify.com/CVE-2026-73719/): Authenticated Arbitrary File Write Vulnerability leads to Remote Code Execution in HPE Networking Fabric Composer (high 7.2)
- [CVE-2026-73718](https://insights.sbomify.com/CVE-2026-73718/): Cross-site request forgery in Fabric Composer (high 7.4)
- [CVE-2026-73717](https://insights.sbomify.com/CVE-2026-73717/): Unauthenticated Command Injection Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface (high 7.5)
- [CVE-2026-73716](https://insights.sbomify.com/CVE-2026-73716/): Unauthenticated Remote Code Execution in HPE Networking Fabric Composer (high 7.5)
- [CVE-2026-73715](https://insights.sbomify.com/CVE-2026-73715/): Unauthenticated Denial-of-Service (DoS) Vulnerability in the API of HPE Networking Fabric Composer (high 7.5)
- [CVE-2026-73714](https://insights.sbomify.com/CVE-2026-73714/): Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer API (high 7.6)
- [CVE-2026-73713](https://insights.sbomify.com/CVE-2026-73713/): Local Privilege Escalation Vulnerabilities in HPE Networking Fabric Composer (high 7.8)
- [CVE-2026-73712](https://insights.sbomify.com/CVE-2026-73712/): Unauthenticated Remote Code Execution in HPE Networking Fabric Composer API (high 8.1)
- [CVE-2026-73711](https://insights.sbomify.com/CVE-2026-73711/): Unauthenticated Privilege Escalation allows Administrative Access in HPE Networking Fabric Composer API (high 8.1)
- [CVE-2026-73710](https://insights.sbomify.com/CVE-2026-73710/): Unauthenticated Denial of Service Vulnerabilities in API Endpoint of HPE Networking Fabric Composer (high 8.2)
- [CVE-2026-7371](https://insights.sbomify.com/CVE-2026-7371/): GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilities (high 7.4)
- [CVE-2026-73709](https://insights.sbomify.com/CVE-2026-73709/): Unauthenticated Remote Code Execution during HPE Networking Fabric Composer Installation Process (high 8.3)
- [CVE-2026-73708](https://insights.sbomify.com/CVE-2026-73708/): Fault in Business Logic allows Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer (high 8.3)
- [CVE-2026-73707](https://insights.sbomify.com/CVE-2026-73707/): Authenticated Privilege Escalation via Broken Access Control in HPE Networking Fabric Composer API (high 8.5)
- [CVE-2026-73706](https://insights.sbomify.com/CVE-2026-73706/): Authentication Bypass in the API of HPE Networking Fabric Composer allows Data Exposure and Unauthorized Changes (high 8.6)
- [CVE-2026-73705](https://insights.sbomify.com/CVE-2026-73705/): Authenticated Arbitrary File Write leads to Remote Code Execution in HPE Networking Fabric Composer (high 8.8)
- [CVE-2026-73704](https://insights.sbomify.com/CVE-2026-73704/): Authenticated Command Injection Leading to Administrative Access in HPE Networking Fabric Composer API (high 8.8)
- [CVE-2026-73703](https://insights.sbomify.com/CVE-2026-73703/): Cross-site scripting in Fabric Composer (high 8.8)
- [CVE-2026-73702](https://insights.sbomify.com/CVE-2026-73702/): Authenticated Privilege Escalation Vulnerability in the API of HPE Networking Fabric Composer (high 8.8)
- [CVE-2026-73701](https://insights.sbomify.com/CVE-2026-73701/): Unauthenticated Remote Code Execution in HPE Networking Fabric Composer (critical 9.0)
- [CVE-2026-73700](https://insights.sbomify.com/CVE-2026-73700/): Cross-site scripting in Fabric Composer (critical 9.0)
- [CVE-2026-73699](https://insights.sbomify.com/CVE-2026-73699/): FileRun < 2026.3.0 PHP Object Injection via Perms::getPerms() (high 8.6)
- [CVE-2026-73698](https://insights.sbomify.com/CVE-2026-73698/): FileRun < 2026.3.0 Authenticated SQL Injection via Groups Add Action (high 8.6)
- [CVE-2026-73694](https://insights.sbomify.com/CVE-2026-73694/): FileRun < 2026.3.0 OS Command Injection via escapeshellcmd() No-Op Redefinition (high 8.6)
- [CVE-2026-73693](https://insights.sbomify.com/CVE-2026-73693/): FileRun < 2026.3.0 OS Command Injection via PhotoProofSheet Handler (high 8.7)
- [CVE-2026-73683](https://insights.sbomify.com/CVE-2026-73683/): Laravel Socialite Facebook Provider Authentication Bypass via Nonce Replay (critical 9.2)
- [CVE-2026-73680](https://insights.sbomify.com/CVE-2026-73680/): Cockpit CMS 2.14.0 Authenticated Command Injection via FFmpeg Filename (high 8.7)
- [CVE-2026-7368](https://insights.sbomify.com/CVE-2026-7368/): Yarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization (high 8.6)
- [CVE-2026-73679](https://insights.sbomify.com/CVE-2026-73679/): ImpressCMS Authenticated RCE via PHP Custom Tag eval() (high 8.6)
- [CVE-2026-73678](https://insights.sbomify.com/CVE-2026-73678/): MindsDB Minds Platform v26.1.0 Unauthenticated RCE via scratchpad exec() (critical 10.0)
- [CVE-2026-73673](https://insights.sbomify.com/CVE-2026-73673/): Netis NC63 V3.0.0.3327 Unauthenticated Firmware Update with Missing Cryptographic Firmware Authentication (high 8.7)
- [CVE-2026-73671](https://insights.sbomify.com/CVE-2026-73671/): Saurus CMS Unauthenticated Open Redirect via logout url parameter (medium 5.1)
- [CVE-2026-73670](https://insights.sbomify.com/CVE-2026-73670/): CMS Admin SQL Injection via db_data.php table_name Parameter (high 8.6)
- [CVE-2026-73669](https://insights.sbomify.com/CVE-2026-73669/): Signify Philips Hue Bridge Pro MQTT broker missing authentication (medium 6.9)
- [CVE-2026-73668](https://insights.sbomify.com/CVE-2026-73668/): Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values (critical 9.8)
- [CVE-2026-73667](https://insights.sbomify.com/CVE-2026-73667/): OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods (high 8.8)
- [CVE-2026-73666](https://insights.sbomify.com/CVE-2026-73666/): Missing authorization in backstage-plugins (high 8.2)
- [CVE-2026-73665](https://insights.sbomify.com/CVE-2026-73665/): FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection (critical 9.3)
- [CVE-2026-73664](https://insights.sbomify.com/CVE-2026-73664/): FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module (high 8.6)
- [CVE-2026-73663](https://insights.sbomify.com/CVE-2026-73663/): FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover (critical 9.3)
- [CVE-2026-73662](https://insights.sbomify.com/CVE-2026-73662/): Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files (high 7.6)
- [CVE-2026-73661](https://insights.sbomify.com/CVE-2026-73661/): FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup (high 8.6)
- [CVE-2026-73660](https://insights.sbomify.com/CVE-2026-73660/): FreePBX: Authenticated TTS AGI Command Injection Through TTS Name (high 7.5)

---
From sbomify Insights: https://insights.sbomify.com/years/2026/page/398/