Hewlett Packard Enterprise (HPE)
Page 3 of 6 — Hewlett Packard Enterprise (HPE) CVEs from a corpus of 598, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37185 | Medium | 5.5 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2025-37184 | Critical | 9.8 | 2026-01-14 | A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Succe… |
CVE-2025-37183 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37182 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37181 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37186 | High | 7.8 | 2026-01-13 | A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of thi… |
CVE-2025-37179 | Medium | 5.3 | 2026-01-13 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation… |
CVE-2025-37178 | Medium | 5.3 | 2026-01-13 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation… |
CVE-2025-37177 | Medium | 6.5 | 2026-01-13 | An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating syst… |
CVE-2025-37176 | Medium | 6.5 | 2026-01-13 | A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting th… |
CVE-2025-37175 | High | 7.2 | 2026-01-13 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Succe… |
CVE-2025-37174 | High | 7.2 | 2026-01-13 | Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating s… |
CVE-2025-37173 | High | 7.2 | 2026-01-13 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems… |
CVE-2025-37172 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37171 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37170 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37169 | High | 7.2 | 2026-01-13 | A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated… |
CVE-2025-37168 | High | 8.2 | 2026-01-13 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation… |
CVE-2025-37166 | High | 7.5 | 2026-01-13 | A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-re… |
CVE-2025-37165 | High | 7.5 | 2026-01-13 | A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A mali… |
CVE-2025-37164 | Critical | 10.0 | 2025-12-16 | A remote code execution issue exists in HPE OneView. |
CVE-2025-37162 | Medium | 6.5 | 2025-11-18 | A vulnerability in the command line interface of affected devices could allow an authenticated remote attacker to conduct a command injection attack. Successfu… |
CVE-2025-37161 | High | 7.5 | 2025-11-18 | A vulnerability in the web-based management interface of affected products could allow an unauthenticated remote attacker to cause a denial of service. Succes… |
CVE-2025-37163 | High | 7.2 | 2025-11-18 | A command injection vulnerability has been identified in the command line interface of the HPE Aruba Networking Airwave Platform. An authenticated attacker cou… |
CVE-2025-37160 | Medium | 5.3 | 2025-11-18 | A broken access control (BAC) vulnerability in the web-based management interface could allow an authenticated remote attacker with low privileges to view sens… |
CVE-2025-37159 | Medium | 5.8 | 2025-11-18 | A vulnerability in the web management interface of the AOS-CX OS user authentication service could allow an authenticated remote attacker to hijack an active u… |
CVE-2025-37158 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37157 | Medium | 6.7 | 2025-11-18 | A command injection vulnerability exists in the AOS-CX Operating System. Successful exploitation could allow an authenticated remote attacker to conduct a Remo… |
CVE-2025-37156 | Medium | 6.8 | 2025-11-18 | A platform-level denial-of-service (DoS) vulnerability exists in ArubaOS-CX software. Successful exploitation of this vulnerability could allow an attacker wit… |
CVE-2025-37155 | High | 7.8 | 2025-11-18 | A vulnerability in the SSH restricted shell interface of the network management services allows improper access control for authenticated read-only users. If s… |
CVE-2025-37148 | Medium | 6.5 | 2025-10-14 | A vulnerability in the parsing of ethernet frames in AOS-8 Instant and AOS 10 could allow an unauthenticated remote attacker to conduct a denial of service att… |
CVE-2025-37147 | High | 7.1 | 2025-10-14 | A Secure Boot Bypass Vulnerability exists in affected Access Points that allows an adversary to bypass the hardware root of trust verification in place to ensu… |
CVE-2025-37146 | High | 7.2 | 2025-10-14 | A vulnerability in the web-based management interface of network access point configuration services could allow an authenticated remote attacker to perform re… |
CVE-2025-37145 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successf… |
CVE-2025-37144 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in a low-level interface library in AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successf… |
CVE-2025-37143 | Medium | 4.9 | 2025-10-14 | An arbitrary file download vulnerability exists in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. S… |
CVE-2025-37142 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37141 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37140 | Medium | 4.9 | 2025-10-14 | Arbitrary file download vulnerabilities exist in the CLI binary of AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation… |
CVE-2025-37139 | Medium | 6.0 | 2025-10-14 | A vulnerability in an AOS firmware binary allows an authenticated malicious actor to permanently delete necessary boot information. Successful exploitation may… |
CVE-2025-37138 | Medium | 6.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the command line interface binary of AOS-10 GW and AOS-8 Controllers/Mobility Conductor operating sy… |
CVE-2025-37137 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37136 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37135 | Medium | 6.5 | 2025-10-14 | Arbitrary file deletion vulnerabilities have been identified in the command-line interface of an AOS-8 Controller/Mobility Conductor. Successful exploitation o… |
CVE-2025-37134 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37133 | High | 7.2 | 2025-10-14 | An authenticated command injection vulnerability exists in the CLI binary of an AOS-8 Controller/Mobility Conductor operating system. Successful exploitation c… |
CVE-2025-37132 | High | 7.2 | 2025-10-14 | An arbitrary file write vulnerability exists in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating syst… |
CVE-2025-37149 | Medium | 6.0 | 2025-10-14 | A potential out-of-bound reads vulnerability in HPE ProLiant RL300 Gen11 Server's UEFI firmware. |
CVE-2025-37122 | Medium | 6.1 | 2025-09-17 | A vulnerability in the web-based management interface of network access control services could allow an unauthenticated remote attacker to conduct a Reflected… |
CVE-2025-37131 | Medium | 4.9 | 2025-09-16 | A vulnerability in EdgeConnect SD-WAN ECOS could allow an authenticated remote threat actor with admin privileges to access sensitive unauthorized system files… |
CVE-2025-37130 | Medium | 6.5 | 2025-09-16 | A vulnerability in the command-line interface of EdgeConnect SD-WAN could allow an authenticated attacker to read arbitrary files within the system. Successful… |
CVE-2025-37129 | Medium | 6.7 | 2025-09-16 | A vulnerable feature in the command line interface of EdgeConnect SD-WAN could allow an authenticated attacker to exploit built-in script execution capabilitie… |
CVE-2025-37128 | Medium | 6.8 | 2025-09-16 | A vulnerability in the web API of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to terminate arbitrary running… |
CVE-2025-37127 | High | 7.2 | 2025-09-16 | A vulnerability in the cryptographic logic used by HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to gain shell… |
CVE-2025-37126 | High | 7.2 | 2025-09-16 | A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN Gateways Command Line Interface that allows remote authenticated users to run arbitrary c… |
CVE-2025-37125 | High | 7.5 | 2025-09-16 | A broken access control vulnerability exists in HPE Aruba Networking EdgeConnect OS (ECOS). Successful exploitation could allow an attacker to bypass firewall… |
CVE-2025-37124 | High | 8.6 | 2025-09-16 | A vulnerability in the HPE Aruba Networking SD-WAN Gateways could allow an unauthenticated remote attacker to bypass firewall protections. Successful exploitat… |
CVE-2025-37123 | High | 8.8 | 2025-09-16 | A vulnerability in the command-line interface of HPE Aruba Networking EdgeConnect SD-WAN Gateways could allow an authenticated remote attacker to escalate priv… |
CVE-2025-37109 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-37108 | Low | 3.5 | 2025-07-31 | Cross-site scripting vulnerability has been identified in HPE Telco Service Activator product |
CVE-2025-37104 | High | 7.1 | 2025-07-16 | A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQ… |
CVE-2025-37103 | Critical | 9.8 | 2025-07-08 | Hard-coded login credentials were found in HPE Networking Instant On Access Points, allowing anyone with knowledge of it to bypass normal device authenticati… |
CVE-2025-37102 | High | 7.2 | 2025-07-08 | An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A successful exploitation… |
CVE-2025-37100 | High | 7.7 | 2025-06-10 | A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploit… |
CVE-2025-37096 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37095 | Critical | 9.8 | 2025-06-02 | A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37094 | Medium | 5.5 | 2025-06-02 | A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37093 | Critical | 9.8 | 2025-06-02 | An authentication bypass vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37092 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37091 | High | 7.2 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37090 | Critical | 9.8 | 2025-06-02 | A server-side request forgery vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37089 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37088 | Medium | 6.8 | 2025-04-22 | A security vulnerability has been identified in HPE Cray Data Virtualization Service (DVS). Depending on race conditions and configuration, this vulnerability… |
CVE-2025-27087 | Medium | 5.5 | 2025-04-22 | A vulnerability in the kernel of the Cray Operating System (COS) could allow an attacker to perform a local Denial of Service (DoS) attack. |
CVE-2025-37087 | Critical | 9.8 | 2025-04-22 | A vulnerability in the cmdb service of the HPE Performance Cluster Manager (HPCM) could allow an attacker to gain access to an arbitrary file on the server hos… |
CVE-2025-27085 | Medium | 4.9 | 2025-04-08 | Multiple vulnerabilities exist in the web-based management interface of AOS-10 GW and AOS-8 Controller/Mobility Conductor. Successful exploitation of these vul… |
CVE-2025-27084 | Medium | 5.4 | 2025-04-08 | A vulnerability in the Captive Portal of an AOS-10 GW and AOS-8 Controller/Mobility Conductor could allow a remote attacker to conduct a reflected cross-site s… |
CVE-2025-27083 | High | 7.2 | 2025-04-08 | Authenticated command injection vulnerabilities exist in the AOS-10 GW and AOS-8 Controller/Mobility Conductor web-based management interface. Successful explo… |
CVE-2025-27082 | High | 7.2 | 2025-04-08 | Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating system… |
CVE-2025-27079 | Medium | 6.0 | 2025-04-08 | A vulnerability in the file creation process on the command line interface of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to perfo… |
CVE-2025-27078 | Medium | 6.5 | 2025-04-08 | A vulnerability in a system binary of AOS-8 Instant and AOS-10 AP could allow an authenticated remote attacker to inject commands into the underlying operating… |
CVE-2025-25041 | Medium | 5.5 | 2025-04-01 | A vulnerability in the HPE Aruba Networking Virtual Intranet Access (VIA) client could allow malicious users to overwrite arbitrary files as NT AUTHORITY\SYSTE… |
CVE-2024-24456 | Medium | 5.9 | 2025-03-31 | An E-RAB Release Command packet containing a malformed NAS PDU will cause the Athonet MME to immediately crash, potentially due to a buffer overflow. |
CVE-2025-27080 | Medium | 6.0 | 2025-03-18 | Vulnerabilities in the command line interface of AOS-CX could allow an authenticated remote attacker to expose sensitive information. Successful exploitation c… |
CVE-2025-25042 | Medium | 4.3 | 2025-03-18 | A vulnerability in the AOS-CX REST interface could allow an authenticated remote attacker with low privileges to view sensitive information. Successful exploit… |
CVE-2025-25040 | Low | 3.3 | 2025-03-18 | A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects… |
CVE-2025-25039 | Medium | 4.7 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrar… |
CVE-2025-23060 | Medium | 6.6 | 2025-02-04 | A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vu… |
CVE-2025-23059 | Medium | 6.8 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If… |
CVE-2025-23058 | High | 8.8 | 2025-02-04 | A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauth… |
CVE-2025-23057 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23056 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23055 | Medium | 5.5 | 2025-01-28 | A vulnerability in the web management interface of HPE Aruba Networking Fabric Composer could allow an authenticated remote attacker to conduct a stored cross-… |
CVE-2025-23054 | Medium | 6.5 | 2025-01-28 | A vulnerability in the web-based management interface of HPE Aruba Networking Fabric Composer could allow an authenticated low privilege operator user to perfo… |
CVE-2025-23053 | Medium | 6.5 | 2025-01-28 | A privilege escalation vulnerability exists in the web-based management interface of HPE Aruba Networking Fabric Composer. Successful exploitation could allow… |
CVE-2025-23052 | High | 7.2 | 2025-01-14 | Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability coul… |
CVE-2025-23051 | High | 7.2 | 2025-01-14 | An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitat… |
CVE-2024-54010 | Low | 3.4 | 2025-01-08 | A vulnerability in the firewall component of HPE Aruba Networking CX 10000 Series Switches exists. It could allow an unauthenticated adjacent attacker to cond… |
CVE-2024-54007 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |
CVE-2024-54006 | High | 7.2 | 2025-01-07 | Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execut… |