The Royal Elementor Addons WordPress plugin versions before 1.7.1070 contain a vulnerability where submitted form field values are not validated before being used in email recipient addresses. This allows unauthenticated attackers to modify the recipient list and send emails from the site's domain if a recipient field echoes user input.
The Smart Popup WordPress plugin by Supsystic before version 2.0.2 contains a vulnerability where template-injection payloads can be stored and later executed by its template engine. This occurs because the filter intended to remove template delimiters runs before a decoding step that reconstructs them. An authenticated administrator can exploit this to execute arbitrary template expressions on the server, potentially exposing sensitive PHP constants such as database credentials and authentication keys.
The BitPay Gateway for WooCommerce WordPress plugin versions through 4.1.3 has a vulnerability where it does not bind the payment provider's transaction confirmation to the specific order nor verify the confirmed payment amount. This flaw allows an unauthenticated attacker who possesses a valid low-value transaction to mark other arbitrary higher-value orders as paid without authorization.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a high CVSS score of 9.6, indicating critical severity. No specific patch information is provided in the source data.
A vulnerability in pretix when used as an identity provider in Single-Sign-On (SSO) setups allows improper validation of the response_type parameter. Specifically, if an SSO client is configured to only allow the 'code' response type, an attacker could request an 'id_token' response type and receive a valid token. Exploitation requires the attacker to execute JavaScript on a page specified by the redirect_uri, which must be pre-approved in the client configuration.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to perform unauthorized operations. The vulnerability is identified as CWE-862 and has a CVSS v3.1 score of 7.1, indicating high severity.
CVE-2026-112197 is a critical vulnerability in the NoviGest Desktop App's Java RMI service caused by lack of authentication in critical functions. An attacker with network access can invoke remote methods without authentication, leading to exposure of sensitive credentials and arbitrary SQL query execution on the PostgreSQL database. The database account's elevated privileges allow chaining these actions to execute operating system commands on the server, compromising confidentiality, integrity, and availability.
A vulnerability in certain API endpoints allowed creation of order payments referencing gift cards by using an unchecked auto-incremented internal ID. This flaw enabled attackers to reference gift cards from different organizers and obtain their secret. Although the gift card itself was not charged, triggering a refund on the payment could increase the gift card's value.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw allows an unauthenticated remote attacker to potentially execute arbitrary commands on affected systems. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the data. No known exploits in the wild have been reported.
The Sadad QA Payment WordPress plugin versions through 1.28 contain a vulnerability where incoming payment notifications are not properly authenticated. This is due to the verification relying on a merchant secret that is empty by default and the rest of the signed data being attacker-controlled. As a result, unauthenticated attackers can forge valid payment confirmations and mark orders as paid without actual payment.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS command injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity. No public exploits or known active exploitation have been reported. Patch availability is not confirmed from the provided data.
An XML External Entity (XXE) injection vulnerability exists in the SAFT import feature of the NoviGest Desktop App. The vulnerability arises because the application processes user-supplied XML files using a JAXB Unmarshaller without disabling external entity resolution. This allows an attacker who can supply crafted XML files to read local files accessible to the application process. If the application runs with elevated privileges, sensitive system files could be exposed.
A vulnerability in The Essential Addons for Elementor WordPress plugin versions before 6.8.7 allows unauthenticated users to register and log in without administrator approval when using the email one-time-password registration flow, if both the approval and OTP features are enabled.
A vulnerability exists where mechanism binding files generated during a shredding process for authentication are not functioning correctly, causing the same session token to be used for all token-based API users. This issue is similar to one fixed in version 2026.7.1 but was missed in that fix. The files are referenced by randomly generated UUIDs and exist only for a day, which limits the risk. The flaw renders the intended protection mechanism ineffective. The fix includes improved hardening of related code areas.
CVE-2025-30414 is a local privilege escalation vulnerability caused by improper authentication in Acronis Cyber Protect Cloud Agent (Windows) and Acronis Cyber Protect 17 (Windows). It affects versions before build 42569 and 42587 respectively. The vulnerability allows a local attacker with limited privileges to escalate their privileges on the affected system.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a vulnerability related to allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on availability. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the source data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a heap-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. There is no information on available patches or vendor advisories. No known exploits are reported in the wild.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and specified LTS releases contain an authentication bypass vulnerability. This flaw allows a low privileged remote attacker to spoof authentication, potentially causing denial of service. The vulnerability does not impact confidentiality but can affect integrity and availability.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity. No information about patches or fixes is provided in the data. No known exploits in the wild have been reported.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access to the system. The vulnerability is identified as CWE-862 and has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. No public exploits or known exploitation in the wild have been reported. Patch or remediation details are not provided in the available data.