Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a low privileged attacker with remote access to gain unauthorized access. The vulnerability has a high severity score of 8.8 (CVSS 3.1) indicating critical impact on confidentiality, integrity, and availability.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an out-of-bounds write vulnerability. This flaw could be exploited by a low privileged attacker with remote access to cause a denial of service condition.
CVE-2026-87098 is a vulnerability in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 that allows sensitive information disclosure due to improper authorization. The flaw has a low severity rating with a CVSS score of 3.1. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper authentication vulnerability. This flaw allows a low privileged attacker with remote access to potentially bypass protection mechanisms. The vulnerability has a high severity with a CVSS score of 8.3. No public exploits or known active exploitation are reported. Patch status is not confirmed due to lack of vendor advisory or patch information.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain an SQL Injection vulnerability. This flaw allows a low privileged remote attacker to potentially gain unauthorized access to managed systems. The vulnerability is critical with a CVSS score of 9.6, indicating high impact on confidentiality and integrity without requiring user interaction.
The Royal Elementor Addons WordPress plugin versions before 1.7.1070 contain a vulnerability where submitted form field values are not validated before being used in email recipient addresses. This allows unauthenticated attackers to modify the recipient list and send emails from the site's domain if a recipient field echoes user input.
The BitPay Gateway for WooCommerce WordPress plugin versions through 4.1.3 has a vulnerability where it does not bind the payment provider's transaction confirmation to the specific order nor verify the confirmed payment amount. This flaw allows an unauthenticated attacker who possesses a valid low-value transaction to mark other arbitrary higher-value orders as paid without authorization.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a high CVSS score of 9.6, indicating critical severity. No specific patch information is provided in the source data.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to perform unauthorized operations. The vulnerability is identified as CWE-862 and has a CVSS v3.1 score of 7.1, indicating high severity.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw allows an unauthenticated remote attacker to potentially execute arbitrary commands on affected systems. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the data. No known exploits in the wild have been reported.
The Sadad QA Payment WordPress plugin versions through 1.28 contain a vulnerability where incoming payment notifications are not properly authenticated. This is due to the verification relying on a merchant secret that is empty by default and the rest of the signed data being attacker-controlled. As a result, unauthenticated attackers can forge valid payment confirmations and mark orders as paid without actual payment.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS command injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity. No public exploits or known active exploitation have been reported. Patch availability is not confirmed from the provided data.
A vulnerability exists where mechanism binding files generated during a shredding process for authentication are not functioning correctly, causing the same session token to be used for all token-based API users. This issue is similar to one fixed in version 2026.7.1 but was missed in that fix. The files are referenced by randomly generated UUIDs and exist only for a day, which limits the risk. The flaw renders the intended protection mechanism ineffective. The fix includes improved hardening of related code areas.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a vulnerability related to allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on availability. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the source data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a heap-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. There is no information on available patches or vendor advisories. No known exploits are reported in the wild.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and specified LTS releases contain an authentication bypass vulnerability. This flaw allows a low privileged remote attacker to spoof authentication, potentially causing denial of service. The vulnerability does not impact confidentiality but can affect integrity and availability.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit this flaw to execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 score of 7.2, indicating high severity. No information about patches or fixes is provided in the data. No known exploits in the wild have been reported.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access to the system. The vulnerability is identified as CWE-862 and has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. No public exploits or known exploitation in the wild have been reported. Patch or remediation details are not provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with remote access to potentially elevate their privileges further. The vulnerability is identified as CWE-269 and has a CVSS v3.1 score of 7.2, indicating a high severity impact on confidentiality, integrity, and availability. No public exploits or patches are currently documented in the provided data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated remote attacker could exploit this flaw to expose credentials, potentially allowing access to the system with the privileges of the compromised user. The vulnerability is rated critical with a CVSS score of 9.8.