CVE-2026-46737

Dell PowerProtect Data Manager (versions prior to 20.2.0.0) contains an Improper Input Validation vulnerability in its REST API. A high-privilege attacker with remote access could exploit this flaw to achieve remote code execution. In practice, this affects the REST API surface and is mitigated b...

CVE-2026-46737

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...

CVE-2026-46738

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-46738

Dell PowerProtect Data Manager is affected (versions prior to 20.2.0.0). The issue is an Improper Input Validation in the REST API that can be triggered over the network. A highly privileged attacker with remote access could exploit this to achieve an Elevation of Privileges . The available docum...

CVE-2026-14865

In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion...

CVE-2026-13187

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...

EUVD-2026-47697

In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of...

CVE-2026-13188

The vulnerability CVE-2026-13188 affects Progress Telerik UI for ASP.NET AJAX prior to v2026.2.708. In DialogHandler, request parameters may be tampered with, potentially altering server-side dialog behavior and enabling chained exploitation. Impact as stated: no confidentiality leakage, but inte...

CVE-2026-13187 DialogHandler Provider Type Tampering Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation...

CVE-2026-13187

The CVE-2026-13187 vulnerability affects Progress Telerik UI for ASP.NET AJAX (prior to v2026.2.708). The issue concerns the DialogHandler provider type input, which can be tampered with, potentially altering dialog processing and enabling chained exploitation. Affected product: Telerik UI for AJ...

CVE-2026-13183

The vulnerability CVE-2026-13183 affects In Progress Telerik UI for ASP.NET AJAX, specifically the RadAsyncUpload component prior to version 2026.2.708. The root cause is a flaw in upload metadata processing that may allow an attacker to infer cryptographic validity through measurable timing diff...

EUVD-2026-47688

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values...

CVE-2026-13183 RadAsyncUpload Upload Metadata Timing Oracle Vulnerability in Telerik UI for ASP.NET AJAX

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values...

CVE-2026-13182

The vulnerability CVE-2026-13182 affects Progress Telerik UI for ASP.NET AJAX (RadAsyncUpload) up to version 2026.2.708. The issue arises from RadAsyncUpload client-state processing that can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that may leak protected ...

CVE-2026-55708 Privacy/configuration issue when adding local data in views through 'unbound-control'

In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, the 'viewlocaldata' and 'viewlocaldatas' commands of 'unbound-control' create a bare local zones tree for an already configured named view when the view is configured with no local data to begin with. However, the creation through the contro...

tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated

Apache Tomcat did not validate HTTP/2 request headers, triggering unexpected application behavior, as applications may presume that header values exposed through the Servlet API would be valid...

CVE-2026-44187

A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text with...

kernel: scsi: core: Wake up the error handler when final completions race against each other

Race condition vulnerabilities were found in the Linux kernel's SCSI error handler wake-up logic. Memory ordering issues in scsidechostbusy and ordering problems in scsiehinchostfailed can cause the SCSI error handler to never wake up when command completions race against each other. This leaves...

CVE-2026-65595 n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token Exchange

n8n before 2.30.1 and 2.29.8 assigns all Public API key scopes to JWTs issued through the Token Exchange module regardless of the acting user's role. On instances where the Token Exchange feature and Public API are enabled, a low-privileged user who can obtain a valid external JWT trusted by a...

OPENSUSE-SU-2026:21412-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-15392: failure to validate symbolic links during table path resolution could allow unauthorized file reads and writes outside the configured data director bsc1271629. - CVE-2026-15043: DBI:SQL:Nano has incorrect predicate evaluation,...