PT-2026-126379

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery SSRF vulnerability. An...

PT-2026-126394

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high...

WatchGuard Fireware OS path traversal vulnerability

Security vulnerabilities exist in WatchGuard Fireware OS versions from 2025.1 up to and including 2026.4, as well as versions from 12.0 up to and including 12.12.4 and from 12.0 up to and including 12.5.22. These vulnerabilities stem from a link-following issue in the firewall daemon. Local...

PT-2026-126439

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Relative Path Traversal vulnerability. A high privilege...

Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Vulnerabilities related to permission and access control exist in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from improper access control and can be exploited by...

ROS-20261027-73-0095

The Media component vulnerability in Google Chrome is related to insecure privilege management. Exploitation of this vulnerability may allow a remote attacker to gain access to sensitive data via a specially crafted HTML page...

PT-2026-126396

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high...

Google Compute Engine authorization issue vulnerability

Versions of Google Compute Engine prior to 2026-08-31 contain an authorization issue vulnerability. This vulnerability stems from missing authorization checks in the disks.createSnapshot and regionDisks.createSnapshot APIs, potentially allowing authenticated attackers to steal cross-project disk...

NVIDIA TensorRT-LLM server request forgery vulnerability

NVIDIA TensorRT-LLM version 1.3.0rc24 contains a server-side request forgery vulnerability. This vulnerability arises from susceptibility to server-side request forgery attacks, potentially leading to information disclosure and data tampering...

PT-2026-126341

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

ROS-20261027-73-0090

The vulnerability in the OpenSSH cryptographic protection tool is related to insecure privilege management. Exploitation of this vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause a denial of service...

PT-2026-126614

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized that allows unauthenticated visitors to read / clockwork/ profiler data via a loopback REMOTE ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting...

PT-2026-126398

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module Qt Core in Qt 5 and earlier impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and ma...

PT-2026-127187

Summary A SQL Injection vulnerability exists in the Third Party Company update functionality of Dolibarr ERP/CRM. The localtax1 value parameter lt1 is concatenated directly into an SQL UPDATE statement in societe/class/societe.class.php at line 1672 without any escaping, type casting, or...

PT-2026-126345

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...

PT-2026-126404

NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial o...

PT-2026-127228

Name of the Vulnerable Software and Affected Versions Crass versions prior to 1.0.8 Description Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped when consuming the remnants of a bad URL. This causes declarations, style rules, or at-rules to remain inside a bad...

CVE-2026-116695: Interpretation Conflict

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...

PT-2026-127751

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been...

PT-2026-126686

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...