Threat database

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability. This flaw allows a low privileged remote attacker to potentially disclose information. The vulnerability does not impact integrity or availability and has a medium severity rating.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an integer overflow or wraparound vulnerability. A high privileged attacker with remote access could exploit this flaw to achieve code execution. The vulnerability is tracked as CVE-2026-86389 and has a CVSS 3.1 base score of 7.2, indicating high severity. No patch or remediation information is provided in the available data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 contain an improper check for dropped privileges vulnerability. This flaw allows a low privileged attacker with remote access to potentially elevate their privileges. The vulnerability is rated high severity with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a high privileged attacker with remote access to potentially disclose sensitive information. The vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 6.8, indicating medium severity.

CVE-2026-105457 is a path traversal vulnerability in HAVELSAN Inc. Liman MYS versions before 2.3.5-1132. This flaw allows an attacker with low privileges to access restricted directories by manipulating pathnames. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including LTS2024, LTS2025, and LTS2026 release versions, contain an OS command injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CVE-2026-86379 and has a CVSS score of 7.2, indicating high severity.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an integer overflow or wraparound vulnerability. This flaw could allow a high privileged remote attacker to bypass protection mechanisms. The vulnerability has a CVSS score of 7.2, indicating high severity. No public exploits or patches are currently documented.

A Blind SQL Injection vulnerability exists in Futurum Software’s management software due to insufficient validation and sanitization of user inputs in database queries and an incorrect Web Application Firewall (WAF) configuration. This flaw allows attackers to bypass protection mechanisms by sending manipulated HTTP requests. Exploitation could enable unauthenticated attackers to execute arbitrary SQL queries, extract the database structure, and access sensitive customer data including personally identifiable information (PII).

CVE-2026-118039 is an XML External Entity (XXE) vulnerability in Progress Software's Telerik Document Processing Libraries before version 2026.3.1027. The flaw exists in SVG image processing, where an unauthenticated attacker can exploit a crafted SVG image containing a nested embedded SVG to read local files on the server during image processing or PDF export. This vulnerability has a high severity score of 7.5 and allows unauthorized disclosure of sensitive information without requiring user interaction or privileges.

CVE-2026-118038 is a path traversal vulnerability in Progress Software's Telerik Document Processing Libraries prior to version 2026.3.1027. It affects the Convert and Merge AI agent tools, allowing an authenticated low-privilege attacker who can supply tool arguments to read and overwrite files outside the configured output directory using relative file paths. The vulnerability is fixed in version 2026.3.1027.

HCL BigFix AEX version 13.0.0.1 is affected by a Server-Side Request Forgery (SSRF) vulnerability. This flaw could allow an attacker with low privileges to cause the application to send unauthorized requests to external resources. Exploitation may lead to access to unintended services or disclosure of sensitive information. The vulnerability has a medium severity rating with a CVSS score of 4.2.

HCL BigFix AEX version 13.0.0.1 is affected by a Clickjacking vulnerability (CWE-1021) that allows attackers to embed the application in malicious web pages or iframes. This can trick users into performing unintended actions, potentially causing unauthorized transactions or account changes. The vulnerability has a CVSS 3.1 score of 6.4, indicating medium severity.

HCL BigFix AEX version 13.0.0.1 contains an information disclosure vulnerability due to improper handling of error messages. This flaw can reveal sensitive technical information such as stack traces, system details, or internal paths. Such disclosures may aid attackers in crafting further attacks. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No public exploits or patches are currently documented.

HCL BigFix AEX version 13.0.0.1 suffers from an unrestricted file upload vulnerability that allows attackers to upload malicious or unauthorized files. This flaw also involves improper access control, enabling direct access or download of sensitive uploaded content. Exploitation could lead to information disclosure, unauthorized access, or system compromise.

CVE-2026-67074 is a critical remote code execution vulnerability in HCL BigFix AEX version 13.0.0.1. It allows attackers to execute arbitrary code with the privileges of the affected application, potentially leading to unauthorized access, data exposure, or full system compromise.

A China-linked threat actor exploited chained vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) and a Linux kernel privilege escalation flaw (CVE-2026-46300, Fragnesia) to gain root access to firewalls of a US government-affiliated organization. The attackers used an internet asset search engine to identify vulnerable firewalls, successfully compromised 25 devices, and deployed persistent PHP root webshells on 24 of them. They further used a reverse SSH tunnel to access an internal firewall management server, extracting sensitive configurations and credentials, and attempted Active Directory backdoor creation. The attacks targeted firewalls in the US, Japan, Taiwan, and South Korea, indicating a strategic focus on these regions. The incident highlights a sophisticated multi-stage exploitation chain with significant impact on network security and domain control.

A stored cross-site scripting (XSS) vulnerability exists in the iCagenda extension for Joomla, specifically in the url-type event Custom Field. This affects versions 3.2.1 through 4.0.16 of the extension. The vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed with high impact on confidentiality and integrity, requiring user interaction.

Dell iDRAC Service Module (iSM) for Windows, Linux, and ESXi versions prior to 6.1.1.0 contain a code injection vulnerability (CWE-94). This flaw allows a high privileged local attacker to potentially elevate privileges. The vulnerability is addressed in version 6.1.1.0 and later. The CVSS score is 4.2, indicating medium severity.

CVE-2026-114278 is a critical OS command injection vulnerability in Eclipse Che's che-machine-exec service. The service improperly concatenates user input from JSON endpoints into shell commands without escaping, allowing remote attackers to execute arbitrary commands in containers when authentication is disabled (default setting).

A CSV formula injection vulnerability exists in the iCagenda extension for Joomla versions 3.5.0 through 4.0.16. This flaw involves improper neutralization of formula elements in CSV files generated by the registrations export feature, which could allow malicious formulas to be injected into exported CSV data.