CVEs published in October 2026

CVE-2026-106078Critical

CVE-2026-106077Critical

CVE-2026-106076Critical

CVE-2025-64394Critical

CVE-2026-111422High

In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, although they are placed inside an already-quoted wrapper script, so shell syntax such as `$(...)` in a value was executed on the remote SSH host

CVE-2026-115748High

Account compromise via missing authentication check in In-Band Registration

CVE-2026-115721High

**UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of memory condition

CVE-2026-90885High

Information disclosure via XML external entity injection

CVE-2026-94386Medium

Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component

CVE-2026-110748Medium

Unauthorized file access via unvalidated file paths in data files

CVE-2026-110733High

Vulnerability in the SQL storage module of Apache SIS

CVE-2026-95628Medium

Path traversal via unvalidated absolute paths

CVE-2026-95629Medium

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Docling component

CVE-2026-95663Medium

Insufficient Session Expiration vulnerability in Apache Camel Keycloak component

CVE-2026-95664Medium

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in Apache Camel AWS2-s3 component

CVE-2026-101259Medium

Information disclosure via verbose error responses

CVE-2026-114820Critical

Distrust eMudhra intermediate CA certificates due to security concerns

CVE-2026-115557Critical

Distrust compromised eMudhra intermediate certificates in Python ssl module

CVE-2026-89422Critical

Erlang/OTP Vulnerability in NetApp Products

CVE-2026-43304Critical

Linux Kernel Vulnerability in NetApp Products

CVE-2026-41681Critical

Rust-OpenSSL Vulnerability in NetApp Products

CVE-2026-41678Critical

Rust-OpenSSL Vulnerability in NetApp Products

CVE-2026-41677Medium

Rust-OpenSSL Vulnerability in NetApp Products

CVE-2026-41676Critical

Rust-OpenSSL Vulnerability in NetApp Products

CVE-2026-31637Critical

Linux Kernel Vulnerability in NetApp Products

CVE-2026-106074Critical

predictable random values via snapshot entropy cache reuse

CVE-2026-106073Critical

Filesystem read permission bypass via fs.realpathSync

CVE-2026-106072Critical

Node.js Vulnerability in NetApp Products

CVE-2026-106071Critical

Permission model bypass via wildcard path matching flaw

CVE-2026-106070Critical

Security inspection bypass via crafted ZIP archive header mismatch

CVE-2026-105481Critical

Response desynchronization via improper HTTP keep-alive connection reuse

CVE-2026-96185High

Microsoft Exchange Online Remote Code Execution Vulnerability

CVE-2026-114583Medium

CPython Vulnerability in NetApp Products

CVE-2026-95721Low

AOS-8: memory corruption vulnerability exists in the web-based management interface of AOS-8

CVE-2026-95720Medium

AOS-8: buffer overflow vulnerability exists in AOS-8 that could allow an authenticated attacker with administrative access to cause denial of service

CVE-2026-95719Medium

AOS-10: arbitrary file deletion vulnerability exists in the command line interface of AOS-10 that could allow an authenticated attacker with administrative privileges to cause a denial of service

CVE-2026-95718Medium

AOS-8: authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls

CVE-2026-95717Medium

Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface

CVE-2026-95716Medium

AOS-10: authentication bypass in the PAPI protocol of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls

CVE-2026-95715Medium

AOS-10: unauthenticated command injection vulnerability exists in the command line interface of AOS-10

CVE-2026-95714Medium

AOS-10: buffer overflow vulnerability exists in the API of AOS-10 that could allow an authenticated adjacent attacker with high privileges to achieve remote code execution

CVE-2026-95713High

AOS-8: unauthenticated buffer overflow vulnerability exists in the command line interface of AOS-8

CVE-2026-95712High

AOS-8: sensitive information disclosure vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to access limited information handled by the affected service

CVE-2026-95711High

AOS-10: authentication bypass vulnerability in the web-based management interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met

CVE-2026-95710High

AOS-10: unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack

CVE-2026-95709High

AOS-10: Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection

CVE-2026-95708High

AOS-10: Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an authenticated remote attacker with high privileges to perform command injection

CVE-2026-95707High

AOS-8: buffer overflow vulnerability in the PAPI protocol of AOS-8 could allow an authenticated remote attacker with high privileges to achieve remote code execution

CVE-2026-95706High

AOS-8: Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection

CVE-2026-95705High

AOS-8: Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection

CVE-2026-95704High

Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface

CVE-2026-79956High

AOS-8: vulnerability in the CLI command handling of the AOS-8 web interface could allow an authenticated remote attacker to execute arbitrary commands on the underlying operating system

CVE-2026-79955High

AOS-8: unauthenticated memory corruption vulnerability exists in a service accessed via the PAPI protocol in AOS-8 that could allow an unauthenticated remote attacker to conduct a denial of service attack

CVE-2026-79895High

AOS-10: Vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack

CVE-2026-79894High

AOS-8: unauthenticated Denial-of-Service (DoS) vulnerability exists in the PAPI protocol of AOS-8

CVE-2026-79893High

AOS-10: Memory corruption vulnerabilities in AOS-10 could allow an unauthenticated remote attacker to conduct a denial of service attack

CVE-2026-79892High

AOS-8: memory corruption vulnerability exists in AOS-8 that could allow an authenticated local attacker to execute arbitrary code

CVE-2026-79891High

AOS-8: buffer overflow vulnerability exists in the command line interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met

CVE-2026-79890High

AOS-8: There are command injection vulnerabilities in AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets

CVE-2026-79889High

AOS-8: Vulnerabilities in multiple web interface endpoints of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow by using specially crafted requests

CVE-2026-79888High

AOS-8: vulnerability in a certain web interface endpoint of AOS-8 devices could allow an unauthenticated remote attacker to trigger a buffer overflow

CVE-2026-79887High

AOS-8: vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution

CVE-2026-79886High

AOS-8: unauthenticated buffer overflow vulnerability exists in the PAPI protocol of AOS-8

CVE-2026-79885High

AOS-8: unauthenticated file write vulnerability exists in the PAPI protocol in AOS-8

CVE-2026-79884High

AOS-8: vulnerability in the web-based management interface of AOS-8 could allow an unauthenticated adjacent attacker to bypass existing authentication controls and access sensitive information

CVE-2026-79883High

AOS-10: buffer overflow vulnerability in the PAPI protocol of HPE Networking AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information

CVE-2026-79882High

AOS-10: There is a command injection vulnerability in the PAPI protocol of AOS-10 that could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted packets

CVE-2026-79881High

AOS-8: authentication bypass vulnerability in the underlying operating system of AOS-8 could allow an unauthenticated remote attacker to circumvent existing authentication controls

CVE-2026-79880High

AOS-8: vulnerability in the command line interface of AOS-8 could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery (SSRF) attack

CVE-2026-79879High

AOS-10: Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent attacker

CVE-2026-79878High

AOS-8: command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote code execution by an adjacent attacker sending specially crafted PAPI packets destined to the PAPI UDP port 8211

CVE-2026-79877High

AOS-10: remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execute arbitrary code on an affected device

CVE-2026-79876Critical

AOS-10: sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information

CVE-2026-79875Critical

AOS-8: vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls

CVE-2026-79874Critical

AOS-10: authentication bypass in the API of AOS-10 allows an unauthenticated adjacent attacker to circumvent existing authentication controls

CVE-2026-79873Critical

AOS-10: Authentication bypass vulnerabilities in the PAPI protocol of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls

CVE-2026-79872Critical

Unauthenticated Buffer Overflow Vulnerability allows Remote Code Execution in AOS-10 and AOS-8

CVE-2026-79871Critical

AOS-10: sensitive information disclosure vulnerability in the command line interface of AOS-10 could allow an unauthenticated remote attacker to access sensitive information

CVE-2026-79870Critical

AOS-8: authentication bypass vulnerability in the PAPI protocol of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls

CVE-2026-79869Critical

AOS-10: Authentication bypass vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls

CVE-2026-79868Critical

AOS-8: Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls

CVE-2026-79867Critical

AOS-8: Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent existing authentication controls and run arbitrary commands on the underlying host

CVE-2026-79866Critical

AOS-8: unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8

CVE-2026-79865Critical

AOS-10: memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote code execution

CVE-2026-79864Critical

AOS-10: Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection

CVE-2026-79863Critical

AOS-10: Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface

CVE-2026-79862Critical

AOS-10: Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arbitrary code by sending specially crafted data to the affected interface

CVE-2026-79861Critical

AOS-10: There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted PAPI packets

CVE-2026-79860Critical

AOS-8: Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's access point management protocol) UDP port 8211

CVE-2026-79859Critical

AOS-8: Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution

CVE-2026-79858Critical

AOS-8: unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8

CVE-2026-79857Critical

AOS-8: There is a command injection vulnerability in the PAPI protocol (Aruba's access point management protocol) of AOS-8 that could lead to unauthenticated remote code execution by sending specially crafted packets to the affected UDP port

CVE-2026-79856Critical

AOS-8: buffer overflow vulnerability exists in the PAPI protocol of AOS-8 that could allow an unauthenticated remote attacker to circumvent existing authentication controls

CVE-2026-79855Critical

AOS-8: authentication bypass vulnerability in the SSH daemon of AOS-8 allows an unauthenticated remote attacker to circumvent existing authentication controls

CVE-2026-79854Critical

AOS-10: vulnerability in the affected interface of AOS-10 could allow an unauthenticated remote attacker to conduct SQL injection attacks against the AOS-10 instance

CVE-2026-79853Critical

AOS-10: Sensitive information disclosure vulnerabilities in the affected interface of AOS-10 could allow an unauthenticated remote attacker to obtain sensitive information from the affected system

CVE-2026-79852Critical

Unauthenticated SQL Injection allows Remote Code Execution in AOS Web-Based Management Interface

CVE-2026-79851Critical

Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution in AOS-10

CVE-2026-79850Critical

Authentication Bypass Leading to Remote Code Execution in AOS-8

CVE-2026-79849Critical

Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8