A stored cross-site scripting (XSS) vulnerability exists in YITH WooCommerce Ajax Product Filter up to version 5.24.0. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact.
P-Net versions before 1.0.4 have a vulnerability where the IP configuration from a DCP Set request is saved to both current and non-volatile configurations before verifying the device state. If the request is refused, such as when an Application Relationship is active, the configuration is not reverted and remains saved. After a restart, the device uses the refused IP address, potentially causing communication issues with the controller or address conflicts. An attacker with adjacent network access can exploit this behavior while an Application Relationship is active.
A vulnerability in PublishPress Gutenberg Blocks (advanced-gutenberg) allows insertion of sensitive information into sent data, potentially exposing embedded sensitive data. This affects versions up to and including 3.7.6. The vulnerability has a medium severity with a CVSS score of 5.3.
Dell PowerStore contains an authorization-bypass vulnerability that could allow a user with limited privileges to elevate their access to administrator level. This vulnerability is identified as CVE-2026-86356 and has a high severity rating with a CVSS score of 8.8. No specific affected versions or patches have been provided in the available data.
Dell PowerStore has a vulnerability involving the use of broken cryptography. This flaw allows a low-privileged attacker to impersonate another identity, which could lead to unauthorized access. The vulnerability has a high severity rating with a CVSS score of 7.1. No specific affected versions or patches are currently documented.
A stored cross-site scripting (XSS) vulnerability exists in WProyal Royal Elementor Addons up to version 1.7.1070. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Dell PowerStore contains an insecure-file-permissions vulnerability (CVE-2026-116412) that allows a local low-privileged attacker to disclose administrative credentials. The vulnerability has a medium severity with a CVSS score of 5.5. There is no information about affected versions or available patches.
P-Net versions before 1.0.4 have a vulnerability where the alarm receiver state is set to waiting for confirmation before parsing alarm notification data. If parsing fails, the state is not restored, causing subsequent alarms of the same priority to be discarded without acknowledgment until the Application Relationship is released. This issue requires the attacker to have adjacent network access and an established Application Relationship context.
A stored cross-site scripting (XSS) vulnerability exists in MapSVG versions up to and including 9.0.4. This vulnerability is due to improper neutralization of input during web page generation, which could allow an attacker with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity impact on confidentiality, integrity, and availability.
P-Net versions before 1.0.4 have a vulnerability where received RTA alarm frames are routed to an Application Relationship based solely on the destination alarm reference, without verifying the source. This allows an attacker with adjacent network access to abort established Application Relationships or send forged alarm notifications with arbitrary parameters.
A time-of-check time-of-use (TOCTOU) race condition vulnerability exists in the Pardus Package Installer developed by TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü. This vulnerability affects versions from 0.7.0 up to but not including 0.7.1. It allows an attacker to leverage the race condition between checking and using a resource, potentially leading to high impact on confidentiality, integrity, and availability.
An authorization bypass vulnerability exists in WebinarIgnition up to version 4.27.125 due to user-controlled key manipulation that leads to incorrect access control enforcement. This flaw allows unauthorized access to certain functions or data without proper privileges.
P-Net versions before 1.0.4 contain a vulnerability where the software does not properly validate the number of MCR request blocks in a Connect request. This can lead to out-of-bounds writes into adjacent Application Relationship structures. Exploitation requires adjacent network access and no established Application Relationship is needed. Builds with PNET_OPTION_MC_CR disabled are not affected.
A missing authorization vulnerability exists in Brainstorm Force Spectra ultimate-addons-for-gutenberg versions up to 2.20.5. This flaw allows exploitation of incorrectly configured access control security levels, potentially enabling unauthorized access to certain functionality or data. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact primarily affecting confidentiality. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
Dell PowerStore appliances have a vulnerability involving external control of file name or path. This flaw can be exploited by a remote authenticated attacker to escalate privileges on the appliance. The vulnerability has a high severity rating with a CVSS score of 8.3.
A race condition vulnerability exists in Automattic WooCommerce versions 11.0.0 through 11.2.2 due to improper synchronization when concurrently accessing shared resources. This flaw could allow an attacker to leverage timing issues to cause unintended behavior. The vulnerability has a CVSS score of 6.5, indicating medium severity with high confidentiality impact but limited integrity and no availability impact.
Dell PowerStore contains an improper input validation vulnerability that allows an authenticated low-privileged attacker to potentially execute stored cross-site scripting (XSS) attacks in the management interface. This vulnerability has a medium severity rating and requires user interaction for exploitation.
A missing authorization vulnerability exists in Brizy up to version 2.8.25. This flaw allows unauthorized users to exploit incorrectly configured access control security levels, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 5.3, indicating a medium severity level.
Devices running firmware versions prior to 4.1.0 are vulnerable to crashes and becoming unavailable when they receive specific malformed Bluetooth messages from unauthenticated attackers. This vulnerability does not impact confidentiality or integrity but causes a denial of service condition.
Dell PowerStore 500T contains an OS Command Injection vulnerability (CWE-78) that allows an authenticated user with limited privileges to potentially escalate their privileges to root on the appliance. This vulnerability is critical and has a CVSS score of 9.1. A fix is available in version 5.1.0.0-2798105 or later.