CVE-2026-108337

Password Reset Code Accessible in User Listing API

An administrator could retrieve the password reset code for any user and take over the account. The password reset codes were included in the output of an API and could be used to reset the password of any account. The API is limited to use by administrator accounts only. An attacker who already has administrative access to the application could compromise the credentials of other accounts on the application. Device credentials and customer data cannot be accessed with this vulnerability.

CVSS 4.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Hitachi

Products

Vantara Remote Ops Agent

CVE-2026-102298

Insufficient Authorization and User Boundary Validation in Omada Controller MSP

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid passwords, and successful authentication.  Successful exploitation may allow user enumeration, credential verification, and unauthorized access to MSP resources or compromise of targeted accounts.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Tp-link

Products

Omada Software Controller

CVE-2026-73799

HPE NonStop SNMP Trap Multiplexer - Memory Corruption vulnerability

A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruption

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Snmp Trap Multiplexer

CVE-2026-76656

HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability

A vulnerability in HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service when traceroute is executed under certain conditions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Tcp/ip Utilities

CVE-2026-76659

HPE NonStop TCP/IP UTILITIES - Denial of Service vulnerability

A vulnerability in the finger daemon of HPE NonStop TCP/IP UTILITIES could allow an unauthenticated remote attacker to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Tcp/ip Utilities

CVE-2026-79822

HPE NonStop TNS/X Native Inspect - Execution flow vulnerability

A security vulnerability in HPE NonStop TNS/X Native Inspect may cause corruption of address and potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Tns/x Native Inspect

CVE-2026-101290

CVE-2026-101290

A remote attacker may send a specially crafted network packet that causes the affected application to perform an out-of-bounds memory read due to insufficient validation of packet length. This may result in an application crash and a denial-of-service condition.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Sick Ag

Products

Sick Safetyscanners Base Cpp Driver

CVE-2026-79823

HPE NonStop EMS Distributor - Buffer Overflow vulnerability

HPE NonStop EMS Distributor is vulnerable to buffer overflow condition that may result in undesirable behavior.

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Ems Distributor

CVE-2026-47786

Pre-Authentication Command Injection

An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Qnap Systems

Products

Hybriddesk Station

CVE-2026-79827

HPE NonStop Inspect Subsystem - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Inspect Subsystem

CVE-2026-79828

HPE NonStop Debug Utilities - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Debug Utilities

CVE-2026-79829

HPE NonStop HTTP WEBSERVER - Memory corruption vulnerability

A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Http Webserver

CVE-2026-110726

Default Rate‑Limit Key Resolver Allows Unlimited Bypass via X‑Forwarded‑For Manipulation

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Connected Services Platform

CVE-2026-110724

Rate Limiting Bypass via Untrusted X‑Forwarded‑For Header in Eclipse Connected Services Platform API Gateway

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Connected Services Platform

CVE-2026-110723

API Gateway Bypass of Rate Limiting via Untrusted X-Forwarded-For Header

In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eclipse

Products

Connected Services Platform

CVE-2026-105065

WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress-extensions

Products

Xstore Xstore

CVE-2026-103936

libp2p: Single pre-auth STUN packet terminates `@libp2p/webrtc` WebRTC-direct Node.js listeners

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Libp2p

Products

Libp2p Webrtc

CVE-2026-103083

WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Elextensions Wordpress-extensions

Products

Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes

CVE-2026-96449

WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpexperts

Products

Wp Easypay Wp Easypay

CVE-2026-109689

WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sunshinephotocart Wordpress-extensions

Products

Sunshine Photo Cart Sunshine Photo Cart