Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a path traversal vulnerability (CWE-22) that allows unauthenticated remote attackers to access the filesystem. This vulnerability is fixed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later. The CVSS v3.1 base score is 5.3, indicating medium severity.
MR ROBOT is a sophisticated Android Malware-as-a-Service operation targeting Indian bank customers. It operates on a subscription model allowing cybercriminals to rent customized banking trojans distributed via fake Play Store pages and messaging apps. The malware uses a multi-stage dropper to deploy banking trojans that intercept SMS and OTPs, silently enable call forwarding to bypass two-factor authentication, and overlay phishing screens to steal sensitive financial and identity information. One affiliate compromised 153 devices and intercepted over 5,400 SMS messages. The operation includes a Telegram bot storefront offering about 36 fake apps impersonating banks and government services, with stolen data exfiltrated to Firebase Realtime Database and Telegram channels.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Allocation of Resources Without Limits or Throttling vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.
CVE-2026-105457 is a path traversal vulnerability in HAVELSAN Inc. Liman MYS that allows an attacker with limited privileges to access files outside the intended directory. This affects versions before 2.3.5-1132. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily on confidentiality. A fix is available in version 2.3.5-1132.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Integer Overflow or Wraparound vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution.
The MemberPress plugin for WordPress versions up to and including 1.14.1 contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw arises from a bypassable nonce verification in the save_profile_fields() function, where an isset() check allows attackers to omit the nonce parameter and bypass security. Exploitation can enable unauthenticated attackers to change authenticated users' email addresses via forged requests, potentially leading to account takeover through password reset mechanisms.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially expose information. The vulnerability does not impact integrity or availability and has a low CVSS score of 2.7.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and certain LTS releases contain an SQL Injection vulnerability. This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7, indicating limited impact. No public exploits or patches are currently documented.
The Webheadcoder Multi-Step Forms for Contact Form 7 WordPress plugin is vulnerable to reflected cross-site scripting (XSS) via the 'l10n_print_after' parameter in all versions up to and including 4.7. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires the targeted site to have at least one Contact Form 7 form configured with a [multistep] form-tag, as version 4.7 introduced canonicalization that blocks the attack on non-multistep forms.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain an authentication bypass vulnerability that allows a low privileged remote attacker to elevate privileges. This flaw could also affect other managed Data Domain systems.
A stored cross-site scripting (XSS) vulnerability exists in the DefterAsist Financial Advisor Platform due to improper neutralization of input during web page generation. This vulnerability allows attackers with limited privileges to inject malicious scripts that can be executed in the context of other users. The issue affects versions of the platform up to the date 2026-10-27. The vulnerability has a medium severity rating with a CVSS score of 5.4.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a low privileged remote attacker to potentially access the filesystem beyond intended restrictions. The vulnerability is identified as CWE-22 and has a high severity CVSS score of 8.8. No patch or remediation information is provided in the data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper authentication vulnerability. This flaw allows an unauthenticated remote attacker to potentially create privileged accounts, leading to full system compromise. The vulnerability is rated critical with a CVSS score of 9.8. Dell recommends upgrading to fixed versions as soon as possible.
Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.8, and specific LTS2024, LTS2025, and LTS2026 release versions contain an OS Command Injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including various LTS releases, contain an SQL Injection vulnerability. This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability does not impact integrity or availability and has a low CVSS score of 2.7.
An out-of-bounds write vulnerability exists in the Samsung Open Source escargot project, which allows buffer manipulation. This flaw can lead to integrity and availability impacts but does not affect confidentiality. The vulnerability has a medium severity rating with a CVSS score of 5.4. No affected versions or patch information are provided at this time.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS command injection vulnerability. A low privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system without user interaction.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper authentication vulnerability. This flaw allows an unauthenticated remote attacker to execute arbitrary commands with root privileges, posing a critical risk to system security. Dell recommends upgrading to fixed versions as soon as possible.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper validation of integrity check value vulnerability. This flaw could allow a high privileged attacker with local access to bypass protection mechanisms. The vulnerability is identified as CVE-2026-90720 and has a CVSS v3.1 score of 6.7, indicating a medium severity impact. No public exploits or patches are currently documented.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a high privileged attacker with local access to potentially cause a denial of service. The vulnerability does not impact confidentiality but may affect system availability. The CVSS score is 3.4, indicating a low severity level.
