ARKETEAM Protectel modules PROTECTELMAJ and BDF contain an arbitrary file upload vulnerability that allows any user to upload files and overwrite existing files in a temporary folder. This flaw could lead to execution of embedded JavaScript when an authenticated user downloads the uploaded file. The issue has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain an SQL injection vulnerability due to improper neutralization of input in the "Utilisateur" parameter. This flaw allows a low privileged user to perform SQL injection attacks. The vulnerability has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS Command Injection vulnerability due to improper neutralization of special elements. This flaw allows a high-privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity. No specific affected versions or patch information are provided in the input data.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an Improper Privilege Management vulnerability that allows a low privileged local attacker to potentially elevate their privileges. This vulnerability can lead to full confidentiality, integrity, and availability impact on the affected system.
A critical vulnerability (CVE-2026-116366) has been identified in ClickHouse Server that could allow an unauthenticated user with network access to execute arbitrary code under certain conditions. The vulnerability has a high CVSS 4.0 score of 9.5, indicating severe impact. No affected versions or patch information are provided, and there are no known exploits in the wild at this time.
Delta UFC500 charging stations use a predictable method to generate default credentials for the Service account based on the device serial number. This allows an unauthenticated attacker with adjacent network access to reconstruct or brute-force the password. Successful exploitation enables reading and modifying sensitive settings, including the OCPP backend configuration.
This vulnerability involves the WebUI template database shipping with factory default passwords for all five account types stored in cleartext. These default passwords are identical across devices and were not changed on the tested unit, posing a significant security risk.
An information disclosure vulnerability exists in the Forocoches comments editor. An attacker can exploit this by inserting an image with a malicious external URL into a comment. When a user views the affected discussion thread, their browser sends a request to the attacker's server, exposing user information such as IP address, User-Agent, and access metadata. This compromises user privacy.
CVE-2025-31704 is a critical remote code execution vulnerability in the Dahua Intelligent Connection Center. It allows an unauthenticated remote attacker to send specially crafted requests that execute arbitrary commands on the affected system. This vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
This vulnerability involves a web server that fails to enforce authentication checks on POST or PUT requests. An unauthenticated attacker can exploit this flaw to reboot the device. Additionally, by brute-forcing the configuration identifier (configid), the attacker can set the service password and modify any configuration settings.
CVE-2026-22114 describes a vulnerability in HTTP basic authentication where no retry limit or backoff mechanism is enforced. This allows an attacker to exhaust the keyspace, especially when default service passwords are used.
DateTime::Lite versions prior to 0.8.1 for Perl contain an inefficient algorithmic complexity vulnerability that allows CPU exhaustion. The vulnerability arises from a per-day loop in the _normalize_leap_seconds function when adding seconds to a DateTime object with a non-floating time zone. This loop iterates approximately |n|/86400 times for adding n seconds, with no limit on n, enabling an attacker controlling the number of seconds added to cause prolonged CPU usage.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an improper input validation vulnerability (CWE-20) that allows a low privileged attacker with adjacent network access to potentially execute code. This vulnerability is rated high severity with a CVSS score of 8. A fix is available in version 4.8.0 and later.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability due to improper restriction of excessive authentication attempts. This flaw allows an unauthenticated attacker with adjacent network access to potentially exploit the system. The vulnerability has a medium severity with a CVSS score of 5.4. A fix is available in version 4.8.0 and later.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability where credentials are insufficiently protected. This flaw could allow a low privileged attacker with remote access to potentially disclose sensitive information. The vulnerability has a medium severity rating and is addressed in version 4.8.0 and later.
A security update for Red Hat OpenStack Platform 17.1 addresses a vulnerability in the python-botocore package, which is a low-level interface for Amazon Web Services. The update distrusts eMudhra intermediate CA certificates due to security concerns identified in CVE-2026-114406. This vulnerability has been rated as having an important security impact by Red Hat Product Security.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a SQL Injection vulnerability (CWE-89) that allows a low privileged remote attacker to potentially expose sensitive information. The vulnerability has a high severity with a CVSS score of 7.1. A fix is available in version 4.8.0 and later.