CVE-2026-116390 is a deserialization of untrusted data vulnerability in the Filter Everything plugin for WordPress and WooCommerce. This flaw allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability. It affects all versions up to and including 1.9.7.
OpenHop versions prior to 0.3.7 contain a path traversal vulnerability in the server component that allows unauthenticated attackers to read or delete YAML files outside the intended directory. This occurs because flow route parameters are passed without an identifier allow-list and are decoded and normalized in a way that permits directory traversal. The vulnerability is exacerbated by permissive CORS settings and default Docker configurations that allow unauthenticated network access. The issue is fixed in version 0.3.7.
CVE-2026-116392 is a deserialization of untrusted data vulnerability in the PickPlugins Accordion plugin, affecting versions up to 2.3.25. This flaw allows object injection, potentially leading to high impact on confidentiality, integrity, and availability. The vulnerability has a CVSS score of 7.2, indicating a high severity level. No public exploits or patches are currently reported.
CVE-2026-116393 is a Missing Authorization vulnerability in iHomefinder, Inc. Optima Express affecting versions up to 9.0.0. The flaw allows unauthorized access due to incorrectly configured access control security levels. It has a high severity with a CVSS score of 7.5, indicating a network exploitable issue that requires no privileges or user interaction and results in high confidentiality impact without affecting integrity or availability.
CVE-2026-115612 is a stored cross-site scripting (XSS) vulnerability in the SliceWP plugin by iova.mihai. It affects versions from initial releases up to 1.2.13. The flaw involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability has a high severity with a CVSS score of 7.1. A fix is available in version 1.2.14.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the loki3.7 packages to address CVE-2026-116591. The advisory includes updated RPMs for multiple architectures and source code. No detailed technical description of the vulnerability is provided beyond the CVE identifier. No fixed versions are explicitly stated in the advisory.
CVE-2026-87102 is a vulnerability in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 that allows sensitive information disclosure and manipulation due to improper token validation. The flaw affects versions prior to build 42587 and has a high severity rating with a CVSS score of 7.4. The vulnerability involves incorrect handling of tokens, which could lead to unauthorized access and modification of sensitive data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a low privileged attacker with remote access to gain unauthorized access. The vulnerability has a high severity score of 8.8 (CVSS 3.1) indicating critical impact on confidentiality, integrity, and availability.
A cross-site scripting (XSS) vulnerability exists in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 due to improper input validation. This vulnerability could allow an attacker with high privileges and user interaction to execute malicious scripts, potentially compromising confidentiality and integrity. The vulnerability has a CVSS 3.0 score of 5.7, indicating medium severity.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an out-of-bounds write vulnerability. This flaw could be exploited by a low privileged attacker with remote access to cause a denial of service condition.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper authentication vulnerability. This flaw allows a low privileged attacker with remote access to potentially bypass protection mechanisms. The vulnerability has a high severity with a CVSS score of 8.3. No public exploits or known active exploitation are reported. Patch status is not confirmed due to lack of vendor advisory or patch information.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain an SQL Injection vulnerability. This flaw allows a low privileged remote attacker to potentially gain unauthorized access to managed systems. The vulnerability is critical with a CVSS score of 9.6, indicating high impact on confidentiality and integrity without requiring user interaction.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a high CVSS score of 9.6, indicating critical severity. No specific patch information is provided in the source data.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to perform unauthorized operations. The vulnerability is identified as CWE-862 and has a CVSS v3.1 score of 7.1, indicating high severity.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw allows an unauthenticated remote attacker to potentially execute arbitrary commands on affected systems. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the data. No known exploits in the wild have been reported.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS command injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity. No public exploits or known active exploitation have been reported. Patch availability is not confirmed from the provided data.
A vulnerability in The Essential Addons for Elementor WordPress plugin versions before 6.8.7 allows unauthenticated users to register and log in without administrator approval when using the email one-time-password registration flow, if both the approval and OTP features are enabled.
A vulnerability exists where mechanism binding files generated during a shredding process for authentication are not functioning correctly, causing the same session token to be used for all token-based API users. This issue is similar to one fixed in version 2026.7.1 but was missed in that fix. The files are referenced by randomly generated UUIDs and exist only for a day, which limits the risk. The flaw renders the intended protection mechanism ineffective. The fix includes improved hardening of related code areas.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a vulnerability related to allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on availability. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the source data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a heap-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. There is no information on available patches or vendor advisories. No known exploits are reported in the wild.