A deserialization of untrusted data vulnerability exists in VillaTheme AFFI – Affiliate Marketing for WooCommerce (affi-affiliate-marketing-for-woo) up to version 1.0.11. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability.
Dell PowerStore contains an out-of-bounds read vulnerability that could be exploited by an attacker to cause denial of service or limited information disclosure. The vulnerability is identified as CVE-2026-111547 and has a high severity rating with a CVSS score of 8.1.
A stack-based buffer overflow vulnerability exists in PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008. This flaw allows unauthenticated attackers to send an HTTP request with an oversized webstax_auth cookie, leading to stack memory corruption and potential denial of service.
A reflected Cross-site Scripting (XSS) vulnerability exists in VillaTheme Catna – Woo Name Your Price and Offers plugin versions up to 2.0.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute arbitrary scripts in the context of the affected web application.
Dell PowerStore contains an integer overflow vulnerability that can be exploited by an authenticated storage host. Successful exploitation may lead to out-of-bounds data access or denial of service conditions.
A relative path traversal vulnerability exists in the demo application's Chat AI Integration example in In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0. This flaw could allow attackers to read files outside the intended chat attachments folder within the server's filesystem scope.
An improper input validation vulnerability exists in Telerik UI for Blazor versions 12.0.0 through 15.2.0. This flaw affects the Grid, TreeList, and Gantt components, allowing their AI command filters to operate on any model property, bypassing the declared column allowlist.
A vulnerability in X.Org xwayland before version 24.1.15 and X Server before version 21.1.26 allows local authenticated X clients to cause a crash or execute code by sending incorrectly handled negative sizes in ProcXvShmPutImage requests.
A stack buffer overflow vulnerability exists in the ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before version 24.1.15 and X server before version 21.1.26. This flaw could allow authenticated clients to crash the X server or potentially execute arbitrary code within it.
An integer overflow vulnerability exists in the XRes QueryResourceBytes Swap Path in X.Org xwayland before version 24.1.15 and X Server before version 21.1.26 on 32-bit systems. This flaw can be exploited by authenticated clients to cause a buffer overread, potentially crashing the X server.
A missing authorization vulnerability exists in WP Chill Passster content-protector, affecting versions up to 4.3.20. This flaw allows exploitation of incorrectly configured access control security levels, potentially leading to unauthorized access. The vulnerability has a medium severity rating with a CVSS score of 6.5.
Dell PowerStore has an improper authorization vulnerability that allows an authenticated user with existing privileges to escalate their privileges to administrator level. This vulnerability could lead to full control over the affected system if exploited.
Dell PowerStore contains an authorization bypass vulnerability (CVE-2026-82179) that allows an authenticated administrator to bypass multi-approver controls on critical operations. This vulnerability has a medium severity score of 4.9 and does not impact confidentiality or availability but affects integrity. No affected versions or patch information are provided.
A vulnerability in FileOrbis NextGen FileServer before version 12.7 involves improper handling of highly compressed data, leading to data amplification. This flaw can cause sustained client engagement, impacting availability. The issue is classified under CWE-409 and has a CVSS 3.1 score of 6.5, indicating a medium severity denial-of-service impact without confidentiality or integrity loss.
Eclipse BaSyx Go Components versions up to and including 1.1.2 have an access control vulnerability in ABAC-enabled deployments of the Submodel Repository and AAS Environment. Specifically, certain GET requests for single Submodels and their metadata do not apply FILTERLIST fragment filters, allowing authenticated users with READ access to view fields that should be hidden by access rules. Additionally, when versioning is enabled, history endpoints return unfiltered data, exposing hidden fields and entire Submodels or Asset Administration Shells that should be restricted. This issue is fixed in version 1.1.3.
P-Net versions before 1.0.4 have a vulnerability where RPC sessions allocated for request fragments with unknown activity UUIDs are kept indefinitely without timeout if the rest of the request never arrives. Sessions without an Application Relationship are also retained after the response. This behavior allows an unauthenticated attacker with adjacent network access to exhaust available sessions by sending repeated fragments or requests with different activity UUIDs, causing a denial of service as the device stops responding to Connect requests until restarted.
A deserialization of untrusted data vulnerability exists in Acowebs PDF Invoices and Packing Slips For WooCommerce up to version 1.4.10. This flaw allows object injection, potentially leading to high impact on confidentiality, integrity, and availability.
P-Net versions prior to 1.0.4 contain a vulnerability where the application relationship of an RPC session is aborted if a fragment of a response is resent without acknowledgment. This occurs due to a NULL pointer dereference when handling fragmented responses on sessions without an application relationship, causing the device to crash. Exploitation requires the attacker to have observed the Application Relationship UUID and have adjacent network access. Conformant IO-controllers do not send such requests, limiting exposure.
Dell PowerStore appliances are affected by an OS Command Injection vulnerability (CVE-2026-82177). This flaw allows a high-privileged attacker to execute arbitrary root commands on the affected system. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity. No specific affected versions or patch information are provided in the available data.
Dell PowerStore appliances contain a vulnerability involving the use of a weak cryptographic algorithm. This flaw could allow an attacker who already has privileged access to the appliance to recover stored credentials. The vulnerability has a medium severity rating with a CVSS score of 5.0. No specific affected versions or patches are currently documented.