CVE-2026-54794

Dell OpenManage Enterprise versions before 4.7.0 contain an unauthenticated, network-accessible SSRF vulnerability (CVSS 7.2 HIGH) enabling information exposure; no in-the-wild exploitation is reported. Remediation is to upgrade to version 4.7.0 or later as documented in Dell DSA-2026-359.

EUVD-2026-62410

Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

CVE-2026-54794

Dell OpenManage Enterprise, versions prior to 4.7.0, contains a Server-Side Request Forgery SSRF vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

EUVD-2026-62478

stigmem versions before 0.9.0a12 contain a broken object level authorization vulnerability in the decay sweep endpoint that allows authenticated attackers with write credentials for one tenant to execute decay operations affecting all tenants. Attackers can submit POST requests to the decay sweep...

CVE-2026-76215

phpMyFAQ before 4.1.7 contains an authorization bypass in its comments and attachments API endpoints. The application fails to enforce parent FAQ visibility checks before returning child resources, allowing unauthenticated attackers to retrieve restricted comment text, commenter email addresses, ...

CVE-2026-76211 phpMyFAQ before 4.1.7 Information Disclosure via Admin API

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIONEDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind...

CVE-2026-76211 phpMyFAQ before 4.1.7 Information Disclosure via Admin API

phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATIONEDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard configuration, allowing any authenticated user to access sensitive administrative data. Attackers can retrieve LDAP server topology, bind...

CVE-2026-76210

phpMyFAQ before 4.1.6 (some sources cite 4.1.7) contains an inadequate HTML sanitization flaw in FAQ answers before PDF generation via TCPDF . An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory (e.g...

EUVD-2026-62447

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...

CVE-2026-76206 phpMyFAQ before 4.1.7 Information Disclosure via PDF Export

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...

CVE-2026-76206

phpMyFAQ versions before 4.1.7 contain an information disclosure vulnerability in the PDF export endpoint . The endpoint fails to validate the active status of FAQ entries, allowing unauthenticated attackers to enumerate sequential FAQ identifiers and retrieve metadata of inactive or unpublished ...

CVE-2026-76206 phpMyFAQ before 4.1.7 Information Disclosure via PDF Export

phpMyFAQ versions before 4.1.7 fail to validate active status in the PDF export endpoint, allowing unauthenticated attackers to retrieve draft FAQ metadata. Attackers can access the public PDF export route with sequential FAQ identifiers to obtain titles, solution IDs, author names, and last-upda...

CVE-2026-75920

phpMyFAQ versions before 4.1.6 create a temporary content.zip backup in the web-accessible document root. Unauthenticated attackers can race concurrent requests to download it before deletion, or chain an admin-context XSS to trigger authenticated backups and retrieve the archive, exposing sensit...

CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

EUVD-2026-62445

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2026-75920 phpMyFAQ before 4.1.6 Information Disclosure via Backup ZIP

phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin...

CVE-2019-25766

Renovate (dependency update automation) versions >= 13.87.0 and

CVE-2026-70424

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...

CVE-2026-70424

Dell OpenManage Enterprise versions prior to 4.7.0 contain a Path Traversal vulnerability (Improper Limitation of a Pathname to a Restricted Directory). A low-privileged attacker with remote access can exploit this to achieve information exposure , with no user interaction required. The CVSS 3.1 ...

EUVD-2026-62440

Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...