OpenPanel SQL injection vulnerability

Versions prior to OpenPanel 3.0.0 contain an SQL injection vulnerability. This vulnerability stems from improper handling of the property parameter in profile.values, potentially allowing authenticated users to inject SELECT statements and disable range-based reads of cross-tenant data via...

SecDMP: Provably Secure Data Memory-Dependent Prefetching (Extended Version)

Data memory-dependent prefetchers DMPs are a microarchitectural optimization recently introduced in mainstream desktop and server CPUs. Although DMPs offer performance improvements, they have been shown to enable side-channel leakage of secrets, even from constant-time code that has been hardened...

Heads of Security: Learned Attention Gates Improve Prompt Injection Robustness

We introduce Heads of Security HoS, a prompt injection defense that enforces instruction-data separation via a small set of learned per-head attention gates. HoS learns how each head should redistribute attention between trusted and untrusted tokens, enabling models to reason over untrusted conte...

PT-2026-126686

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

TinyMCE cross-site scripting vulnerability

Versions of TinyMCE prior to 7.9.3 and from 8.5.1 up to 8.9.3 contain a cross-site scripting vulnerability. This vulnerability arises because the media plugin creates specially crafted elements within active documents via data-mce-object before cleanup; these elements can execute malicious script...

PT-2026-126396

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high...

Dell PowerProtect Data Domain Virtual Edition path traversal vulnerability

Versions 7.7.1.0 through 8.7, LTS2024 versions 7.13.1.0 through 7.13.1.70, LTS2025 versions 8.3.1.0 through 8.3.1.30, and LTS2026 versions 8.6.1.0 through 8.6.1.10 contain a path traversal vulnerability. This vulnerability stems from improper path handling and may allow attackers with remote acce...

Dell PowerProtect Data Domain path traversal vulnerability

Path traversal vulnerabilities exist in Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, 7.13.1.0 through 7.13.1.70, 8.3.1.0 through 8.3.1.30, and 8.6.1.0 through 8.6.1.10. These vulnerabilities stem from relative path traversal flaws in certificates, which can be exploited by remote...

PT-2026-127205

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 153.6 Thunderbird versions prior to 159 Description On Windows, a check designed to prevent mailbox: URLs from accessing files on remote network shares can be bypassed using extended-length UNC paths. This allows ...

PT-2026-126379

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery SSRF vulnerability. An...

ROS-20261027-73-0053

The vulnerability in Tomcat 11 is related to errors in handling length parameters of input data. Exploitation of this vulnerability may allow a remote attacker to cause a denial of service...

PT-2026-126407

NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue. A successful exploit of this vulnerability might lead to data tampering, denial of service and information disclosure...

PT-2026-126436

PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 through 8.6.1.10, contain a Relative Path Traversal vulnerability in the certificate. A...

NVIDIA PhysX buffer error vulnerability

Versions 0.0 through 0.4.1.2 of NVIDIA PhysX contain a buffer error vulnerability stemming from an out-of-bounds write. This vulnerability may lead to code execution, data tampering, denial of service, and information leakage...

Daryll Doyle svg-sanitizer cross-site scripting vulnerability

Versions prior to 1.0.0 of Daryll Doyle’s SVG sanitizer contain a cross-site scripting vulnerability. This flaw stems from CSS injection and remote reference bypass capabilities. Attackers can exploit it by uploading specially crafted SVG files; the unquoted url values or image href attributes ma...

Vulnerability related to permission and access control issues in Dell PowerProtect Data Domain

Versions 7.7.1.0 through 8.7 of Dell PowerProtect Data Domain, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20 contain a vulnerability related to permission and access control issues. This vulnerability stems fr...

PT-2026-126398

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module Qt Core in Qt 5 and earlier impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer. This can cause the application to crash and ma...

Qt buffer error vulnerability

Buffer error vulnerabilities exist in Qt versions 4.5.0 through 6.8.8 and 6.9.0 through 6.11.2. These vulnerabilities stem from an out-of-bounds write in Qt’s iconv-based encoding for QTextCodec. Under certain conditions, when QTextCodec is used to encode text, it may write beyond the boundaries ...

Grafana proxy server Data Read Modify Delete

The proxy server vulnerability in the Grafana monitoring and observability platform is related to access control flaws. Exploitation of this vulnerability may allow a remote attacker to gain read, modify, or delete data...

Node.js HTTPS Bypass

The vulnerability related to the implementation of the HTTPS protocol in the Node.js software platform stems from a lack of validation of host certificate data. Exploitation of this vulnerability could enable a remote attacker to bypass existing security mechanisms...