An SQL injection vulnerability exists in Apache Syncope due to improper neutralization of special elements in SQL commands. This issue is an incomplete fix of a previous vulnerability (CVE-2026-77051) and allows an administrator with sufficient entitlements to execute arbitrary SQL commands via unsanitized opEvent parameters. The vulnerability affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Users are advised to upgrade to versions 4.0.9 or 4.1.4 where the issue is fixed.
Apache Syncope contains an improper isolation vulnerability that allows an administrator with certain entitlements to execute untrusted Groovy code on a separate thread, bypassing the Groovy security sandbox. This affects versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrading to versions 4.0.9 or 4.1.4 addresses this issue.
An authorization bypass vulnerability exists in Apache Syncope allowing a delegated administrator to relocate a Realm subtree across administrative realm boundaries without proper permission. This affects Apache Syncope versions from 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrading to versions 4.0.9 or 4.1.4 resolves this issue.
A SQL injection vulnerability exists in the Starnet Computer and Network Systems Inventory Tracking Application through 2026-10-16. This flaw allows an attacker to inject malicious SQL commands due to improper neutralization of special elements in SQL queries.
An improper privilege management vulnerability in Apache Syncope allows non-admin users to configure impersonation for WA surrogate authentication via AuthProfile self-updates. This affects versions from 3.0.12 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. Upgrading to versions 4.0.9 or 4.1.4 resolves the issue.
A stored cross-site scripting (XSS) vulnerability exists in the Mega Menu Badge Text feature of the Helix Ultimate Joomla extension versions prior to 2.2.11. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw is identified as CVE-2026-105602 and has a high severity rating with a CVSS score of 8.6.
A Missing Authorization vulnerability (CVE-2026-92886) exists in TÜBİTAK BİLGEM Software Technologies Research Institute's eta-register software, affecting versions from 2.0.8 up to but not including 2.0.9. This vulnerability allows privilege escalation due to improper authorization checks.
Dell OpenManage Enterprise versions prior to 4.8.0 have a vulnerability involving improper neutralization of argument delimiters, which could allow a low privileged attacker with adjacent network access to execute commands. The vulnerability is classified as medium severity with a CVSS score of 4.6. No public exploits or patches are currently documented.
Dell OpenManage Enterprise versions prior to 4.8.0 have an improper verification of cryptographic signature vulnerability. This flaw allows a high privileged attacker with adjacent network access to potentially execute code on the affected system. The vulnerability has a medium severity rating with a CVSS score of 5.7. No specific affected versions were explicitly stated beyond 'prior to 4.8.0'. There is no information about available patches or vendor advisories in the provided data.
A high-severity remote code execution (RCE) vulnerability exists in the Joomla extension StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. The flaw involves setting strings that can lead to code execution. This vulnerability is tracked as CVE-2026-105600 with a CVSS 4.0 base score of 8.6.
A Cross-Site Request Forgery (CSRF) vulnerability exists in the Joomla extension php-web-design.com StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. This vulnerability allows unauthorized actions to be performed via CSRF attacks.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a path traversal vulnerability that allows a high privileged attacker with adjacent network access to gain unauthorized filesystem access. This vulnerability could lead to integrity and availability impacts on the affected system.
A PHP code injection vulnerability exists in the Joomla Sourcerer extension versions prior to 17.0.1 when used in combination with the Articles Anywhere extension versions prior to 20.1.1. The issue arises because Articles Anywhere can insert one article into another, and when processing occurs in a certain order with Force Content Triggers disabled, the included article's Sourcerer code may be executed with the trust level of the enclosing article rather than its own. This creates a mismatch in authority validation for executing PHP code within articles.
A stored cross-site scripting (XSS) vulnerability exists in the Media Picker component of the Helix Ultimate Joomla extension versions prior to 2.2.11. This vulnerability allows an attacker with low privileges to inject malicious scripts that are stored and later executed in the context of users interacting with the affected component.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a path traversal vulnerability that allows a low privileged attacker with adjacent network access to potentially expose sensitive information. This vulnerability does not impact integrity or availability but can lead to unauthorized information disclosure.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an OS command injection vulnerability due to improper neutralization of special elements. This flaw allows a low privileged attacker with adjacent network access to execute arbitrary commands on the affected system. The vulnerability has a high severity rating with a CVSS score of 8. No specific patch or fixed version information is provided in the available data.
A vulnerability in the Joomla extension Users Anywhere (regularlabs.com) before version 3.0.1 allows an administrator to bypass settings that disable output of user email addresses or usernames. Specifically, attributes inside {user} or [email]/[username] tags can override plugin settings to display personal data despite restrictions. This does not bypass policies that completely disallow Users Anywhere tags in content sources.
A reflected cross-site scripting (XSS) vulnerability exists in the Joomla Extension php-web-design.com StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. This vulnerability allows an attacker to inject malicious scripts that are reflected off the web server, potentially leading to limited confidentiality and integrity impacts. The issue is identified as CVE-2026-105601 with a medium severity rating and a CVSS 4.0 base score of 5.3.
Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged attacker with local access to bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 5.5.
This vulnerability involves insufficient validation of callback URLs in the affected product, which allows attackers to manipulate these URLs with malicious payloads. Exploitation can lead to crafted links that redirect users to attacker-controlled sites, facilitating phishing attacks and potential unauthorized access or data theft.