PT-2026-126441

PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Process Control vulnerability. A high...

PT-2026-126393

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high...

Dell PowerProtect Data Domain buffer error vulnerability

Buffer error vulnerabilities exist in Dell PowerProtect Data Domain versions from 7.7.1.0 up to LTS 2026, from 7.13.1.0 up to 7.13.1.80, from 8.3.1.0 up to 8.3.1.40, and from 8.6.1.0 up to 8.6.1.20. These vulnerabilities stem from stack buffer overflows, which can be exploited by remote attackers...

Cisco Expressway Unauthorized Access

The vulnerability in the Mobile and Remote Access MRA technology of the Cisco Expressway gateway software involves the exposure of system data to unauthorized parties when processing HTTP requests. Exploitation of this vulnerability could enable a remote attacker to gain unauthorized access to...

Semantic MediaWiki cross-site scripting vulnerability

Semantic MediaWiki versions 5.0.0 through 7.3.1 contain a cross-site scripting vulnerability. This flaw arises because when allowHTML is enabled, ext.smw.tooltip.tippy.js renders data- attributes via innerHTML. Editors can insert .smw-highlighter span elements containing malicious data-content,...

Semantic MediaWiki cross-site request forgery vulnerability

Versions 3.0.0 through 7.3.1 of Semantic MediaWiki contain a cross-site request forgery vulnerability. This flaw arises because Special:SMWAdmin overwrites wpEditToken with a newly generated valid token, making it susceptible to such attacks. Attackers can trick authenticated smw-admin users into...

CVE-2026-116695: Interpretation Conflict

Crass is a Ruby CSS parser that is compliant with the CSS Syntax Level 3 specification. Prior to 1.0.8, Crass incorrectly treats a closing parenthesis after an escaped backslash as escaped while consuming the remnants of a bad URL. Crass therefore keeps declarations, style rules, or at-rules insi...

Dell PowerProtect Data Domain buffer error vulnerability

Buffer error vulnerabilities exist in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20. These vulnerabilities stem from stack buffer overflows and may allow remote attackers with elevated privileges to...

Dell PowerProtect Data Domain server request forgery vulnerability

Versions 7.7.1.0 through 8.7, 7.13.1.0 through 7.13.1.80, 8.3.1.0 through 8.3.1.40, and 8.6.1.0 through 8.6.1.20 of Dell PowerProtect Data Domain contain a server-side request forgery vulnerability. This vulnerability stems from an Server-Side Request Forgery SSRF flaw, which may allow...

OpenPanel SQL injection vulnerability

Versions prior to OpenPanel 3.0.0 contain an SQL injection vulnerability. This vulnerability arises because event names and dates are not properly escaped in ConversionService.getConversion; this allows malicious injection into ClickHouse SQL. As a result, members of read-only projects and owners...

PT-2026-126380

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high...

PT-2026-126394

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Privilege Management vulnerability. A high...

WordPress Bookly 28.2 Insecure Direct Object Reference

WordPress Bookly plugin versions through 28.2 contain an unauthenticated insecure direct object reference that exposes order tokens and calendar appointment data. The included proof of concept enumerates order tokens and extracts calendar data. https://packetstorm.news/download/237870...

CVE-2026-93864: Improper Limitation of a Pathname to a Restricted Directory

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

PT-2026-126406

Name of the Vulnerable Software and Affected Versions NVIDIA NeMo Agent Toolkit versions 1.0 through 1.8.0 Description A missing authentication flaw allows an attacker to bypass security checks. This issue may lead to remote code execution, escalation of privileges, data tampering, denial of...

PT-2026-126373

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF...

CVE-2026-118176: Undefined Security Weakness

Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows...

CVE-2026-117604: Exposure of Sensitive Information to an Unauthorized Actor

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized that allows unauthenticated visitors to read /clockwork/ profiler data via a loopback REMOTEADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting...

Mozilla Thunderbird < 159.0

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 159.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2026-121 advisory. - Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 159...

Amazon Corretto Java 8.x < 8.512.08.1 Multiple Vulnerabilities

The version of Amazon Corretto installed on the remote host is 8 prior to 8.512.08.1. It is, therefore, affected by multiple vulnerabilities as referenced in the corretto-8-2026-Oct-20 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition produ...