ARKETEAM Protectel modules PROTECTELMAJ and BDF contain an arbitrary file upload vulnerability that allows any user to upload files and overwrite existing files in a temporary folder. This flaw could lead to execution of embedded JavaScript when an authenticated user downloads the uploaded file. The issue has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain an SQL injection vulnerability due to improper neutralization of input in the "Utilisateur" parameter. This flaw allows a low privileged user to perform SQL injection attacks. The vulnerability has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS Command Injection vulnerability due to improper neutralization of special elements. This flaw allows a high-privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. No specific affected versions or patch information are provided in the input data.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Privilege Management vulnerability that allows a low privileged local attacker to potentially elevate their privileges. This vulnerability can lead to full confidentiality, integrity, and availability impact on the affected system.
A critical vulnerability (CVE-2026-116366) has been identified in ClickHouse Server that could allow an unauthenticated user with network access to execute arbitrary code under certain conditions. The vulnerability has a high CVSS 4.0 score of 9.5, indicating severe impact. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.
Delta UFC500 charging stations use a predictable method to generate default credentials for the Service account based on the device serial number. This allows an unauthenticated attacker with adjacent network access to reconstruct or brute-force the password. Successful exploitation enables reading and modifying sensitive settings, including the OCPP backend configuration.
This vulnerability involves the WebUI template database shipping with factory default passwords for all five account types stored in cleartext. These default passwords are identical across devices and were not changed on the tested unit, posing a significant security risk.
An information disclosure vulnerability exists in the Forocoches comments editor. An attacker can exploit this by inserting an image with a malicious external URL into a comment. When a user views the affected discussion thread, their browser sends a request to the attacker's server, exposing user information such as IP address, User-Agent, and access metadata. This compromises user privacy.
CVE-2025-31704 is a critical remote code execution vulnerability in the Dahua Intelligent Connection Center. It allows an unauthenticated remote attacker to send specially crafted requests that execute arbitrary commands on the affected system. This vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
This vulnerability involves a web server that fails to enforce authentication checks on POST or PUT requests. An unauthenticated attacker can exploit this flaw to reboot the device. Additionally, by brute-forcing the configuration identifier (configid), the attacker can set the service password and modify any configuration settings.
CVE-2026-22114 describes a vulnerability in HTTP basic authentication where no retry limit or backoff mechanism is enforced. This allows an attacker to exhaust the keyspace, especially when default service passwords are used.
DateTime::Lite versions before 0.8.1 for Perl allow CPU exhaustion via a per-day loop when adding seconds.
_normalize_leap_seconds crosses day boundaries one day at a time, so add(seconds => $n) on an object with a non-floating time zone takes about |$n|/86400 iterations, and nothing limits $n. The XS implementation and the pure-Perl fallback both have the loop.
An attacker who controls the number of seconds added can keep the process busy for as long as they choose.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Input Validation vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Launch of phishing attacks.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Insufficiently Protected Credentials vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
A security update for Red Hat OpenStack Platform 17.1 addresses a vulnerability in the python-botocore package, which is a low-level interface for Amazon Web Services. The update distrusts eMudhra intermediate CA certificates due to security concerns identified in CVE-2026-114406. This vulnerability has been rated as having an important security impact by Red Hat Product Security.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.