CVE-2025-13647 is a vulnerability where the affected component does not properly validate the content-type header in certain requests. This flaw allows attackers to craft requests with manipulated content-type headers, leading to unintended exposure of file paths for certificate files. The information disclosure could aid attackers in further compromising system confidentiality. The vulnerability has a medium severity with a CVSS score of 5.8.
ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 have a vulnerability that allows authenticated users to execute remote code via the Log Forward option. This vulnerability has a high severity score of 8.7 and requires high privileges to exploit, with no user interaction needed.
CVE-2025-12544 is a vulnerability in the Publisher portal where insufficient validation of uploaded SVG files allows users with the Publisher role to inject malicious scripts. Exploitation involves uploading crafted SVG files that are stored and rendered by the application, enabling actions such as browser redirection, UI modification, or information retrieval. The impact is limited by httpOnly flags on session cookies, preventing session hijacking.
CVE-2026-2613 is a high-severity vulnerability in the Admin REST API where user input is not properly sanitized, allowing an administrator to perform blind SQL injection. This can lead to unauthorized inference of database information and potentially disrupt database availability.
CVE-2024-2372 is an open redirection vulnerability where affected components accept user input for redirection URLs without proper validation. This flaw allows attackers to craft URLs that redirect users to arbitrary external domains, facilitating phishing attacks through social engineering.
CVE-2024-7075 is a cross-site scripting (XSS) vulnerability in the user search function of a management console. The function does not properly encode user input before rendering it in the browser, allowing attackers to inject malicious scripts. Exploitation can lead to browser redirection, UI manipulation, or information disclosure from the browser. The vulnerability does not allow session hijacking due to the httpOnly flag on session cookies.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a Cross-site Scripting (CWE-79) vulnerability. This flaw allows an unauthenticated remote attacker to potentially tamper with information by injecting malicious scripts. The vulnerability has a CVSS 3.1 score of 6.8, indicating a medium severity. A fix is available in version 4.8.0 and later.
WSO2 Identity Server versions 5.10.0, 5.11.0, 6.0.0, 6.1.0, 7.0.0, and 7.1.0 contain an open redirect vulnerability due to insufficient validation of callback URLs. This flaw allows attackers to craft malicious links that redirect users to attacker-controlled sites, facilitating phishing attacks and potential data theft.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving improper verification of cryptographic signatures. This flaw allows a high privileged attacker with adjacent network access to potentially execute code on the affected system. The vulnerability is identified as CWE-347 and has a CVSS v3.1 score of 5.7, indicating medium severity. A fix is available in version 4.8.0 and later.
A heap-based buffer overflow vulnerability exists in the SPDY dissector of Wireshark, a network protocol analyzer. This flaw can lead to a denial of service condition. Red Hat has issued a security update addressing this vulnerability in Wireshark packages for Red Hat Enterprise Linux 8 and related products.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability classified as CWE-88 Argument Injection. This flaw allows a low privileged attacker with adjacent network access to potentially execute commands by exploiting improper neutralization of argument delimiters. The vulnerability has a medium severity rating with a CVSS score of 4.6. A fix is available in version 4.8.0 and later.
CVE-2026-91910 is a path traversal vulnerability in Dell OpenManage Enterprise versions prior to 4.8.0. It allows a low privileged attacker with adjacent network access to potentially expose sensitive information by improperly restricting pathname access. The vulnerability has a medium severity with a CVSS score of 5.7.
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
A security vulnerability (CVE-2026-32597) exists in the PyJWT library used in Python, where it accepts unknown 'crit' header extensions, violating RFC 7515 section 4.1.11 requirements. This issue has been addressed by Red Hat in an update for python-jwt packages on Red Hat Enterprise Linux 8.8 variants.
Two critical PHP vulnerabilities affect older deployments of Festo Didactic MES4 products using XAMPP with PHP versions up to 7.3, which are out-of-support and unpatched. Mitigations recommended by the PHP foundation include setting memory_limit=-1 and disabling session upload progress in php.ini, with an optional Apache configuration change that impacts performance. Additional firewall restrictions on the Windows host are suggested to limit communication to trusted sources.
The Apache Thrift Rust crate versions prior to 0.23.0 contain a vulnerability in the TBinaryInputProtocol's read_bytes function, where an attacker-controlled 4-byte length value is used directly to allocate a buffer without bounds checking. This can lead to excessive memory allocation or immediate process abort, causing a denial of service. The issue affects any peer sending binary protocol data and is unauthenticated and network-reachable. The vulnerability is fixed in version 0.23.0 by adding checks against negative sizes and enforcing a maximum string size limit.
CVE-2026-100140 is an integer overflow vulnerability in the Qt XML parsing functionality, specifically in Qt5Compat / QXmlSimpleReader. It affects multiple Qt versions from 6.0.0 through 6.12.0. The vulnerability has a low severity score and no known exploits in the wild.
CVE-2024-9517 is a vulnerability in WSO2 API Manager where the refresh token grant type does not re-validate the account status before issuing new access tokens. This allows attackers to obtain valid access tokens for user accounts even after those accounts have been blocked, bypassing account lockout mechanisms. The flaw can lead to unauthorized access and potential privilege escalation or data exfiltration depending on the compromised account's permissions. The issue affects multiple versions of WSO2 API Manager prior to specific fixed releases. A fix is available in versions starting from 3.1.0.308, 3.2.0.429, 3.2.1.49, 4.0.0.315, 4.1.0.214, 4.2.0.149, 4.3.0.62, 4.4.0.25, and 4.5.0.9 and later.