Authentication bypass in an HPE component enables remote code execution
In related HPE components, an authentication-bypass flaw that uses an alternate path or channel (CWE-288) lets an attacker attack over the network with low complexity and without privileges or user interaction. The vulnerability changes scope and has high confidentiality and integrity impact. An attacker can craft malicious requests to bypass authentication and then take control of the system or obtain sensitive data. All unpatched related HPE components are affected; the attacker only needs network reachability, with no user interaction required for remote exploitation.
Component
HPE (Hewlett Packard Enterprise) provides enterprise IT infrastructure, software, and services; its components are widely used in data centers and cloud environments.
Risks
From ordinary user to administrator: If the victim runs the affected component with administrator privileges, the attacker can obtain the same privileges
Complete system control: An attacker can exploit this vulnerability to execute arbitrary code on the victim system and, depending on user privileges, install programs, view/change/delete data, or create new fully privileged accounts
No-user-interaction attack: Through a remote network attack, the attacker can trigger the vulnerability without user interaction and gain unauthorized access by abusing the authentication bypass
Monitor anomalous authentication requests and access logs
Enforce strict access-control lists (ACLs) in the runtime environment
Block network connection requests from untrusted sources
CVE-2026-79847
CVSS
10.0 Critical
2026-10-23
Improper restriction of operations within memory buffer bounds in an HPE component enables remote code execution
In related HPE components, improper restriction of operations within the bounds of a memory buffer (CWE-119) creates a critical security flaw. An attacker can attack over the network with low complexity and without privileges or user interaction. Successful exploitation changes system scope and has high confidentiality, integrity, and availability impact, and may lead to remote code execution or complete loss of system control. All unpatched affected HPE components are impacted; an attacker can attack remotely over the network with no user interaction required for full control.
Component
HPE (Hewlett Packard Enterprise) provides enterprise compute, storage, and networking solutions; its software components are widely used in data centers and enterprise IT infrastructure.
Risks
From ordinary user to administrator: If the victim runs the affected service with administrator privileges, the attacker can obtain the same privileges
Complete system control: An attacker can exploit this vulnerability to execute arbitrary code on the victim system and, depending on user privileges, install programs, view/change/delete data, or create new fully privileged accounts
No-user-interaction attack: A remote network request can trigger the vulnerability without clicks or other interaction; the attack vector is directly reachable over the network (NETWORK)
Enable sandbox isolation for the runtime environment
Block network requests from untrusted sources and apply official security patches promptly
CVE-2025-30047
CVSS
10.0 Critical
2026-10-23
Deserialization flaw in CGM CLININET enables remote code execution
Before CGM CLININET 2026.MS3, the HTTP-based management API module lacked strict validation of input data and contained a deserialization-of-untrusted-data flaw (CWE-502). An attacker can send a crafted Java serialized object to that API, trigger arbitrary code execution during deserialization, and fully control the server as root. All CGM CLININET users not updated to 2026.MS3 are affected, especially deployments on the same LAN. No authentication is required; successful exploitation leads to complete server takeover.
Component
CGM CLININET is medical information-system software whose server-side management module exchanges data over an HTTP API using Java object serialization.
Risks
Execute arbitrary code as root: An attacker can run arbitrary commands on the server with the highest privileges and fully control the system
Complete system control: An attacker can install malware, steal sensitive medical data, modify or delete critical files, or create new fully privileged accounts
Remote LAN attack: An attacker on the same LAN can send malicious requests directly to the exposed API and trigger the vulnerability without user interaction
Immediately upgrade CGM CLININET to 2026.MS3 or later to fix this vulnerability
Restrict network access to the management API port so only trusted management endpoints can connect
Deploy an intrusion detection system (IDS) to monitor anomalous serialized-data traffic and suspicious process execution
Package Poisoning
6
Package Poisoning
npm2026-10-23
opencode-skills-collection@4.1.16
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
e9743d6b273d061da2b71bfe16e38531
Package Poisoning
npm2026-10-23
imgdecode@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
e0045e77aaf42e2c2420d27f303e8567
Package Poisoning
npm2026-10-23
kvarzo8f3atestmetest@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
01d6d58477bcae8174dbf2314e608950
Package Poisoning
npm2026-10-23
sdk-utils-testmetest@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
b6b7503996e68c3e361edccd2c537cbe
Package Poisoning
npm2026-10-25
tailwind-base-buttons@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
MD5
15ff1c7078fdfbea0cc5ea11ee5f0321
Package Poisoning
npm2026-10-25
tailwindcss-theme-kit@>= 0
flagged as malicious
This version was found communicating with a malicious domain and executing malicious commands. Audit your dependencies and pin safe versions immediately.
