CVE-2026-66269

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism...

CVE-2026-66269

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism...

CVE-2026-66269

Dell OpenManage Server Administrator , versions prior to 11.1.0.3 , contains an Unsafe Reflection vulnerability in which externally controlled input is used to select classes or code. An unauthenticated attacker with remote network access could exploit this flaw, resulting in a protection mechani...

EUVD-2026-81425

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism...

CVE-2026-66269

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism...

PT-2026-94158

Name of the Vulnerable Software and Affected Versions Dictionary WordPress plugin versions prior to 1.1 Description The plugin fails to escape user input before reflecting it in the responses of several directly accessible scripts. This allows unauthenticated attackers to execute Reflected...

PT-2026-94220

Name of the Vulnerable Software and Affected Versions Dell OpenManage Server Administrator versions prior to 11.1.0.3 Description An unauthenticated attacker with remote access can exploit a Use of Externally-Controlled Input to Select Classes or Code Unsafe Reflection issue. Unsafe Reflection...

CVE-2026-66269: Use of Externally-Controlled Input to Select Classes or Code

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview djust is a Phoenix LiveView-style reactive components for Django with Rust-powered performance. Real-time UI updates over WebSocket, no JavaScript build step required. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview apache-airflow-providers-apache-kafka is a Provider package apache-airflow-providers-apache-kafka for Apache Airflow Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' in the importstring function. An...

(0Day) CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a malicious agent configuration from the repository. The specific flaw exists within the...

PT-2026-93835

Name of the Vulnerable Software and Affected Versions CrewAI affected versions not specified Description An unsafe reflection flaw exists in the crewAI Framework during the agent loading process. The load agent from repository function imports content from a provided repository without an...

EUVD-2026-79290

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...

Security Bulletin: Multiple Security Vulnerabilities in Spring HATEOAS Affect IBM Sterling B2B Integrator and IBM Sterling File Gateway

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2026-41006 DESCRIPTION: Spring HATEOAS's internal PropertyUtils.createObjectFromProperties method, used by the Collection+JSON and UBER media type...

CVE-2026-65831 ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/database with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438 Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

EUVD-2026-77514

Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an authenticated user. The Logviewer reflected the request's Origin header back in Access-Control-Allow-Origin while also sending...

CVE-2026-82438

This vulnerability exists in Apache Storm 's HTTP components, where three distinct mechanisms allowed web pages from unrelated origins to access authenticated user responses. Specifically, the Logviewer reflected the Origin header in Access-Control-Allow-Origin while sending Access-Control-Allow-...

Astra Linux – Vulnerability in Linux, BlueZ

In the Bluetooth Core Specification 2.1 through 5.2, Bluetooth LE and BR/EDR secure pairing mechanisms may allow a nearby man-in-the-middle attacker to identify the Passkey used during pairing in the Passkey authentication procedure by reflecting the public key and the authentication evidence of...