CVE-2026-109216

In node-opcua (an OPC UA implementation for TypeScript and Node.js), versions 2.42.0 through 2.180.0 do not honor namespace-level access control configured via setDefaultRolePermissions for nodes without explicit per-node permissions. SessionContext.getApplicableRolePermissions reads a missing or null value instead of the configured namespace field, and the null result is treated permissively. As a result, an anonymous network client can write variables or call bound methods when an operator relied on restrictive namespace defaults.

Dell Wyse Management Suite versions prior to 2609.0.0.155 contain a cross-site scripting vulnerability (improper neutralization of input during web page generation). A low-privileged attacker with remote access could exploit it to inject script.

Incorrect authorization in certificate-name matching in trapperkeeper-authorization, as used by Puppet Server, allows a client holding a CA-signed certificate whose name extends or shortens an authorized hostname to be authorized as that host. This enables impersonation of other nodes and, in Puppet Enterprise, access to certificate-authority administration and remote command execution on managed nodes.

Deserialization of untrusted data in Puppet's report-processing code, as used by Puppet Server, allows a client holding any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by submitting a report with a crafted rich-data type via a PUT request. Where the CA autosigns requests without strong verification, an unauthenticated network attacker can obtain such a certificate.

A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could grant unauthorized administrative access with elevated privileges.

Prior to 0.8.1, fastapi-code-generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted string without escaping embedded quotes. An attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.

Prior to 0.8.1, fastapi-code-generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntactically valid generated code executes with the server process's privileges when the affected route handler is called.

Prior to 0.8.1, fastapi-code-generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. An attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.