CVE-2026-93516 is a use-after-free vulnerability in X.org X Server and XWayland caused by improper lifecycle management when adding or removing XInput master devices. It affects versions of X.org X Server before 21.1.25 and XWayland before 24.1.14. Authenticated X clients could exploit this flaw to crash the X server or potentially execute code within the X server context. The vulnerability has a medium severity rating with a CVSS score of 5.5. Fixes are available in versions 21.1.25 for X.org X Server and 24.1.14 for XWayland.
Waline versions prior to 1.41.1 have an improper authentication vulnerability in the login endpoint where the email field is not properly validated. This allows an attacker to bypass the email check by submitting a non-string email value, causing the system to authenticate against the first user (the administrator) if the password is correct. The vulnerability enables partial authentication bypass, user enumeration, and credential-stuffing amplification. The issue is fixed in version 1.41.1.
CVE-2026-93515 is a use-after-free vulnerability in the present_clear_window_notifies() function of the X.org X Server before version 21.1.25 and X Wayland before version 24.1.14. This flaw could allow malicious X clients with limited privileges to crash the X server or potentially execute code within the server context. The vulnerability has a medium severity rating with a CVSS score of 6.8. Fixed versions are 21.1.25 for X.org X Server and 24.1.14 for X Wayland.
A stored cross-site scripting (XSS) vulnerability exists in the Joomla extension iCagenda versions 3.2.1 through 4.0.16. The flaw is triggered via the url-type event Custom Field, allowing malicious scripts to be stored and potentially executed in users' browsers.
Dell iDRAC Service Module (iSM) versions prior to 6.1.1.0 for Windows, Linux, and ESXi contain a code injection vulnerability. This flaw allows a high privileged local attacker to potentially elevate their privileges. The vulnerability is identified as improper control of code generation (CWE-94). The CVSS score is 4.2, indicating a medium severity level. No patch or remediation details are provided in the available data.
A missing authorization vulnerability exists in the wphocus My auctions allegro my-auctions-allegro-free-edition plugin, affecting versions up to 4.0.3. This flaw allows attackers with limited privileges to bypass access controls, potentially leading to unauthorized information disclosure or modification. The vulnerability is identified as CWE-862 and has a CVSS v3.1 base score of 5.4 (medium severity). No patch or official remediation has been indicated in the available data.
A divide-by-zero vulnerability was identified and resolved in the Linux kernel's IPv4 fib_rebalance function. The issue occurs when concurrent changes cause the first pass of nexthop weight calculation to return zero, while the second pass still sees eligible nexthops, leading to division by zero. The fix sets nexthop upper bounds to -1 when the total is zero, avoiding the division and aligning with a similar IPv6 fix.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a low privileged attacker with remote access to gain unauthorized access. The vulnerability has a high severity score of 8.8 (CVSS 3.1) indicating critical impact on confidentiality, integrity, and availability.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an out-of-bounds write vulnerability. This flaw could be exploited by a low privileged attacker with remote access to cause a denial of service condition.
CVE-2026-87098 is a vulnerability in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 that allows sensitive information disclosure due to improper authorization. The flaw has a low severity rating with a CVSS score of 3.1. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper authentication vulnerability. This flaw allows a low privileged attacker with remote access to potentially bypass protection mechanisms. The vulnerability has a high severity with a CVSS score of 8.3. No public exploits or known active exploitation are reported. Patch status is not confirmed due to lack of vendor advisory or patch information.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain an SQL Injection vulnerability. This flaw allows a low privileged remote attacker to potentially gain unauthorized access to managed systems. The vulnerability is critical with a CVSS score of 9.6, indicating high impact on confidentiality and integrity without requiring user interaction.
The Royal Elementor Addons WordPress plugin versions before 1.7.1070 contain a vulnerability where submitted form field values are not validated before being used in email recipient addresses. This allows unauthenticated attackers to modify the recipient list and send emails from the site's domain if a recipient field echoes user input.
The BitPay Gateway for WooCommerce WordPress plugin versions through 4.1.3 has a vulnerability where it does not bind the payment provider's transaction confirmation to the specific order nor verify the confirmed payment amount. This flaw allows an unauthenticated attacker who possesses a valid low-value transaction to mark other arbitrary higher-value orders as paid without authorization.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including multiple LTS releases, contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially perform unauthorized system operations on managed systems. The vulnerability has a high CVSS score of 9.6, indicating critical severity. No specific patch information is provided in the source data.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to perform unauthorized operations. The vulnerability is identified as CWE-862 and has a CVSS v3.1 score of 7.1, indicating high severity.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw allows an unauthenticated remote attacker to potentially execute arbitrary commands on affected systems. The vulnerability has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the data. No known exploits in the wild have been reported.
The Sadad QA Payment WordPress plugin versions through 1.28 contain a vulnerability where incoming payment notifications are not properly authenticated. This is due to the verification relying on a merchant secret that is empty by default and the rest of the signed data being attacker-controlled. As a result, unauthenticated attackers can forge valid payment confirmations and mark orders as paid without actual payment.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an OS command injection vulnerability. This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is identified as CWE-78 and has a CVSS 3.1 base score of 7.2, indicating high severity. No public exploits or known active exploitation have been reported. Patch availability is not confirmed from the provided data.
A vulnerability exists where mechanism binding files generated during a shredding process for authentication are not functioning correctly, causing the same session token to be used for all token-based API users. This issue is similar to one fixed in version 2026.7.1 but was missed in that fix. The files are referenced by randomly generated UUIDs and exist only for a day, which limits the risk. The flaw renders the intended protection mechanism ineffective. The fix includes improved hardening of related code areas.