CVE-2026-81479

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain a Partial String Comparison vulnerability. A low-privileged attacker with local access can exploit this flaw to cause a Denial of Service . The CVSS 3.1 score is 5.8 (MEDIUM) , reflecting a local attack vector with high compl...

CVE-2026-81478

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this to achieve unauthorized access , with high impact on confidentiality, integrity, and availabil...

CVE-2026-92917

In Grav (a flat-file CMS) versions 2.0.0-rc.1 through 2.0.21 , the Twig content sandbox fails to restrict dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string). The guard GravExtension::assertSandboxDumpSafe() calls SandboxExtension::isSandboxed() without a Source argume...

CVE-2026-92916

Grav, a flat-file CMS, is affected by an unauthenticated information disclosure in versions 1.7.0–1.7.53.2 and 2.0.0–2.0.21 when the debugger is enabled (system.debugger.enabled: true, not the default). The Clockwork profiler endpoint (/__clockwork/) is intercepted during bootstrap without any au...

CVE-2026-92914

AVideo LoginControl is a WordPress plugin for video management. The vulnerability resides in its PGP second-factor authentication mechanism, where challenge responses are compared using loose equality (==) against an uninitialized session variable. An attacker who possesses a victim's password ca...

CVE-2026-92915

WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. The script disables the login requirement, accepts users_id directly from the query string, and calls User::sendVerificationLink() with no session, CSRF, or ra...

CVE-2026-92913

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) uses a cryptographically weak PRNG in getRandomCode() (objects/functions.php), deriving account activation/login pairing codes from uniqid() with a single non-CSPRNG rand() character as padding, reducing the code space to ~2^25 valu...

CVE-2026-92912

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) uses cryptographically weak uniqid() values for RTMP publish keys in its LiveTransmition module. This reduces key entropy to approximately one million possibilities per creation second, allowing an attacker who knows the channel cre...

CVE-2026-81477

Dell OpenManage Server Administrator (OMSA) , versions prior to 11.1.0.3 , contains a Heap-based Buffer Overflow vulnerability. A high-privileged attacker with remote access could potentially exploit this flaw to achieve arbitrary code execution . The CVSS 3.1 score is 7.2 (HIGH) , reflecting a n...

CVE-2026-81476

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain an OS Command Injection vulnerability. An unauthenticated attacker with remote network access could potentially exploit this to achieve remote code execution , with high impact to confidentiality, integrity, and availability ...

CVE-2026-78296

CVE-2026-78296 affects WP ManageNinja LLC's FluentAuth WordPress plugin (versions up to 2.1.2 ). The vulnerability is classified as Insufficient Verification of Data Authenticity , which allows Identity Spoofing through the plugin's email verification mechanism. The CVSS 3.1 score is 5.3 (MEDIUM)...

CVE-2026-81475

Dell OpenManage Server Administrator (OMSA) prior to 11.1.0.3 is affected by a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote network access could exploit this flaw to achieve remote code execution , impacting confidentiality, integrity, and av...

CVE-2026-81439

Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 contain an Incorrect Authorization vulnerability. A low-privileged attacker with remote access could potentially exploit this flaw to achieve a protection mechanism bypass . The CVSS 3.1 score is 3.7 (Low) , with high attack c...

CVE-2026-92903

Improper input validation in Snowflake CLI versions prior to 3.27.0 allows unsanitized, user-controlled values to be interpolated into SQL strings executed as multi-statement queries. An attacker with write or pull-request access to a project repository whose CI/CD pipeline runs Snowflake CLI und...

CVE-2026-81438

Dell OpenManage Server Administrator (OMSA) versions prior to 11.1.0.3 contain a Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote network access could exploit this flaw, resulting in Information disclosure . The CVSS 3.1 score is 3.7 (LOW) , ...

CVE-2026-81474

Dell OpenManage Server Administrator (versions prior to 11.1.0.3 ) contains a Heap-based Buffer Overflow vulnerability. A low-privileged attacker with local access and no user interaction can exploit this to achieve Elevation of Privileges , with high impact on confidentiality, integrity, and ava...

CVE-2026-66269

Dell OpenManage Server Administrator , versions prior to 11.1.0.3 , contains an Unsafe Reflection vulnerability in which externally controlled input is used to select classes or code. An unauthenticated attacker with remote network access could exploit this flaw, resulting in a protection mechani...

CVE-2026-92611

Eclipse Ankaios versions 0.6.0 through 1.0.3 contain a flaw in the agent control-interface authorizer: LogRule::matches stops evaluating at the first wildcard pattern in a single rule instead of processing all entries. This causes deny LogRule entries that appear after a wildcard to be skipped, p...

CVE-2026-92893

CVE-2026-92893 affects the foreman_ansible Ruby gem (a Foreman plugin). The Ansible inventory API controller builds its host query using an unscoped Host.where call that fails to enforce the search filter tied to the caller's view_hosts permission. As a result, an authenticated user whose host vi...

CVE-2026-92894

A flaw in the foreman_ansible plugin 's Ansible override values API allows an authenticated user with the edit_ansible_variables permission to delete any LookupValue record by ID. The destroy action resolves the target without verifying it belongs to an AnsibleVariable the caller is authorized to...