PT-2026-85030

Dell SmartFabric OS10 Software, versions prior to 10.5.6.14, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-84831: Improper Authentication

SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor...

PT-2026-85044

Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter criterion parameters to retrieve usernames holding specific roles, banned flags,...

PT-2026-85273

MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileg...

CVE-2026-84832: Deserialization of Untrusted Data

SEPPmail Secure Email Gateway before 15.0.6 deserializes attacker-controlled data in a privileged REST import workflow without adequate validation. An attacker with a privileged API token can execute arbitrary commands with "nobody" privileges...

PT-2026-84922

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery SSRF vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure...

PT-2026-84923

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API. A low privileged remote attacker could potentially exploit this vulnerability, leading to Protection mechanism bypass...

EUVD-2026-58544

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods...

OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. An authenticated user with permission to configure and trigger an affected workflow...

GHSA-2MW5-23GM-PCCQ OpenChoreo: Authenticated OS command injection via OpenChoreo Workflow Plane templates enables code execution in privileged pods

Summary OpenChoreo Workflow Plane templates were vulnerable to OS command injection because some developer-controlled workflow parameters were interpolated directly into shell program text executed through sh -c. An authenticated user with permission to configure and trigger an affected workflow...

EUVD-2026-70230

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. Thi...

CVE-2026-78590

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

EUVD-2026-70061

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

CVE-2026-78599 Stored Path Traversal in Kibana Leading to Unauthorized Deletion of Internal Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

K000163170: Mbed TLS vulnerability CVE-2026-34877

Security Advisory Description An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary...

PT-2026-84733

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description A path traversal flaw exists in the Kibana Fleet feature. A low-privileged user with write access to Fleet Settings can manipulate pathnames to target restricted directories. This allows the...

CVE-2026-78590: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...