Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Versions 7.7.1.0 through 8.7 of Dell PowerProtect Data Domain, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20 contain a privilege escalation vulnerability related to permission management and access control. Th...

PT-2026-126393

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high...

Mozilla Thunderbird security vulnerabilities

A security vulnerability exists in Mozilla Thunderbird versions prior to 159 and prior to Thunderbird 153.6. It arises because the check for mailbox: URL access to a remote Windows network share can be bypassed via an extended length UNC path. This may lead to connection to a SMB server chosen by...

PT-2026-126341

Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site request forgery vulnerability in Special:SMWAdmin because it overwrites the wpEditToken with a freshly generated valid token. Attackers can lure an authenticated smw-admin user to a malicious page that triggers schema setup,...

PT-2026-127187

Name of the Vulnerable Software and Affected Versions Dolibarr versions prior to 22.0.5 Dolibarr versions prior to 23.0.2 Description A SQL injection issue exists in the Third Party company update functionality. The application concatenates the localtax1 value and localtax2 value properties into ...

PT-2026-126437

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high...

Dell PowerProtect Data Domain path traversal vulnerability

Versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20 of Dell PowerProtect Data Domain contain a path traversal vulnerability. This vulnerability stems from relative path traversal and may allow highly privileged attackers with remote...

Vulnerability in the software supply chain of NVIDIA TensorRT-LLM

NVIDIA TensorRT-LLM version 1.3.0rc24 contains a vulnerability related to the software supply chain. This vulnerability arises from the inclusion of functionality originating from untrusted control domains during the loading process of the KvCacheAwareRouter tokenizer. It may lead to code...

PT-2026-126614

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized that allows unauthenticated visitors to read / clockwork/ profiler data via a loopback REMOTE ADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting...

Cisco Expressway Unauthorized Access

The vulnerability in the Mobile and Remote Access MRA technology of the Cisco Expressway gateway software involves the exposure of system data to unauthorized parties when processing HTTP requests. Exploitation of this vulnerability could enable a remote attacker to gain unauthorized access to...

PT-2026-126345

SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy.js that renders data- attributes via innerHTML with allowHTML enabled. Editors can plant a .smw-highlighter span with a malicious data-content, data-title, data-top, data-bottom...

PT-2026-126404

NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an attacker could cause inclusion of functionality from an untrusted control sphere. A successful exploit might lead to code execution, information disclosure, data tampering, and denial o...

ROS-20261027-73-0025

The vulnerability in openssh is related to errors in handling registration data. Exploitation of this vulnerability can be carried out remotely...

PT-2026-126441

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Process Control vulnerability. A high...

PT-2026-126403

NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, information disclosure...

Dell PowerProtect Data Domain buffer error vulnerability

Buffer error vulnerabilities exist in Dell PowerProtect Data Domain versions from 7.7.1.0 up to LTS 2026, from 7.13.1.0 up to 7.13.1.80, from 8.3.1.0 up to 8.3.1.40, and from 8.6.1.0 up to 8.6.1.20. These vulnerabilities stem from stack buffer overflows, which can be exploited by remote attackers...

PT-2026-126402

NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might lead to information disclosure and data tampering...

CVE-2026-116675: Improper Neutralization of Input During Web Page Generation

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

CVE-2026-118132: Undefined Security Weakness

NextChat version 2.16.1 contains a client‑side cross‑site scripting XSS vulnerability in the Plugin Editor due to unsafe rendering of externally supplied OpenAPI plugin schema content. When a plugin schema is loaded from a remote URL, the returned content is stored in plugin.content and later...

Spesmilo Electrum encryption issue vulnerability

Versions prior to spesmilo electrum 4.7.2, specifically 4.6.0, contain an encryption-related vulnerability. This flaw arises because the external plugin loader executes the init.py module marked as enabled without first verifying the plugin’s password signature. As a result, malicious local...