ROS-20261027-73-0090

The vulnerability in the OpenSSH cryptographic protection tool is related to insecure privilege management. Exploitation of this vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause a denial of service...

PT-2026-126440

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Path Traversal vulnerability. A high...

PT-2026-127751

Impact Stored XSS vulnerability in the media plugin. Attackers can inject malicious scripts via elements crafted through the data-mce-object attribute, which are created and executed before sanitization. Impacts users of TinyMCE with the media plugin enabled. Patches This vulnerability has been...

Linux Distros Unpatched Vulnerability : CVE-2026-101637

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 9.7.0-9.7.3,...

Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Versions 7.7.1.0 through 8.7 of Dell PowerProtect Data Domain, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20 contain a vulnerability related to permission and access control issues. This vulnerability stems fr...

Semantic MediaWiki cross-site scripting vulnerability

Semantic MediaWiki versions 5.0.0 through 7.3.1 contain a cross-site scripting vulnerability. This flaw arises because when allowHTML is enabled, ext.smw.tooltip.tippy.js renders data- attributes via innerHTML. Editors can insert .smw-highlighter span elements containing malicious data-content,...

Semantic MediaWiki cross-site request forgery vulnerability

Versions 3.0.0 through 7.3.1 of Semantic MediaWiki contain a cross-site request forgery vulnerability. This flaw arises because Special:SMWAdmin overwrites wpEditToken with a newly generated valid token, making it susceptible to such attacks. Attackers can trick authenticated smw-admin users into...

Node.js HTTPS Bypass

The vulnerability related to the implementation of the HTTPS protocol in the Node.js software platform stems from a lack of validation of host certificate data. Exploitation of this vulnerability could enable a remote attacker to bypass existing security mechanisms...

Grafana proxy server Data Read Modify Delete

The proxy server vulnerability in the Grafana monitoring and observability platform is related to access control flaws. Exploitation of this vulnerability may allow a remote attacker to gain read, modify, or delete data...

CVE-2026-116695: Interpretation Conflict

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...

NVIDIA PhysX buffer error vulnerability

Versions 0.0 through 0.4.1.2 of NVIDIA PhysX contain a buffer error vulnerability stemming from an out-of-bounds write. This vulnerability may lead to code execution, data tampering, denial of service, and information leakage...

Daryll Doyle svg-sanitizer cross-site scripting vulnerability

Versions prior to 1.0.0 of Daryll Doyle’s SVG sanitizer contain a cross-site scripting vulnerability. This flaw stems from CSS injection and remote reference bypass capabilities. Attackers can exploit it by uploading specially crafted SVG files; the unquoted url values or image href attributes ma...

Dell PowerProtect Data Domain buffer error vulnerability

Buffer error vulnerabilities exist in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from stack buffer overflows and may allow remote attackers with elevated privileges to...

Dell PowerProtect Data Domain server request forgery vulnerability

Versions 7.7.1.0 through 8.7, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20 of Dell PowerProtect Data Domain contain a server-side request forgery vulnerability. This vulnerability stems from an Server-Side Request Forgery SSRF flaw, which may allow...

OpenPanel SQL injection vulnerability

Versions prior to OpenPanel 3.0.0 contain an SQL injection vulnerability. This vulnerability arises because event names and dates are not properly escaped in ConversionService.getConversion; this allows malicious injection into ClickHouse SQL. As a result, members of read-only projects and owners...

PT-2026-126380

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high...

PT-2026-126394

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high...

WordPress Bookly 28.2 Insecure Direct Object Reference

WordPress Bookly plugin versions through 28.2 contain an unauthenticated insecure direct object reference that exposes order tokens and calendar appointment data. The included proof of concept enumerates order tokens and extracts calendar data. https://packetstorm.news/download/237870...

CVE-2026-93864: Improper Limitation of a Pathname to a Restricted Directory

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

PT-2026-126406

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Agent Toolkit versions 1.0 through 1.8.0 Description A missing authentication flaw allows an attacker to bypass security checks. This issue may lead to remote code execution, escalation of privileges, data tampering, denial of...