CVE-2026-8175

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a buffer overflow in the asperahttpd component. This vulnerability could be exploited to cause a denial of service and potentially lead to authentication bypass or remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-817535.1Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled ma CVE-2026-817547.2The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scr CVE-2026-81755Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust serve CVE-2026-817569.3Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions.CVE-2026-817577.2Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.CVE-2026-817586.3Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.CVE-2026-817595.4Contributor Broken Access Control in WpEvently <= 5.5.0 versions.CVE-2026-81767.5The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administra CVE-2026-817607.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected CVE-2026-817614.3Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.CVE-2026-817626.5Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.CVE-2026-817639.3Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions.