Eclipse KeyPont versions 2.0.0-rc3 through 2.0.0-rc8 contain a vulnerability in ML-KEM key-pair lookup functions where the public key is not verified against the private key. This allows an attacker with unauthenticated token access to substitute a public key and receive shared secrets intended for the legitimate private key owner, compromising confidentiality. The issue does not affect v1 module paths which lack ML-KEM support.
CVE-2026-13162 is an OS command injection vulnerability in Hitachi Energy's CoreTec 5 product. It affects the configuration daemon's time synchronization handler, which sets the system time-zone. Authenticated users with certain roles can exploit this flaw by supplying crafted input that is concatenated into shell commands without sanitization, allowing arbitrary system command execution with full device control. The vulnerability affects versions from 3.0.0 through 5.0.0 inclusive. The CVSS 4.0 score is 7.7, indicating high severity.
Apple released updates for iOS and macOS 27.2 addressing 286 vulnerabilities, including memory corruption bugs, privilege escalation flaws, sandbox escapes, and remote code execution issues. A critical zero-day vulnerability in CoreGraphics, exploited in the wild, was backported and fixed in iOS 18.7.11. The updates also patch numerous security holes in components such as WebKit, kernel, image handling, and network services. Additional patches were released for other Apple operating systems and software.
CVE-2026-113644 is an OS command injection vulnerability in Eclipse ioFog's iofogctl CLI tool versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1. The vulnerability arises because the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands executed locally and over SSH on remote agent hosts. An attacker who can modify the API response can inject shell metacharacters, causing arbitrary commands to run on the agent host during deployment or attachment. This issue is fixed in version 3.9.2.
CVE-2026-90728 is an improper privilege management vulnerability in Dell PowerProtect Data Domain affecting multiple feature release and LTS versions. A local attacker with high privileges could exploit this flaw to elevate their privileges further. The vulnerability is rated medium severity with a CVSS score of 6.3. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release branch.
CVE-2026-105323 is a reflected cross-site scripting (XSS) vulnerability in Kulga News Software versions from 26.7.4 up to but not including 26.10.0. This flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity impact primarily affecting confidentiality and integrity with no impact on availability. A fix is available in version 26.10.0.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and several LTS releases contain an improper privilege management vulnerability (CWE-269). A high privileged attacker with remote access could exploit this flaw to elevate their privileges. The vulnerability has a CVSS score of 6.7, indicating medium severity. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
Eclipse ioFog Operator versions 3.8.0 up to but not including 3.9.2 disable TLS certificate verification when communicating with the Controller API and logging into an external OIDC issuer. This improper certificate validation allows an on-path attacker to present any certificate, potentially capturing sensitive credentials such as the OAuth client secret or the Controller bootstrap admin password. The vulnerability was fixed in version 3.9.2.
Eaton easySoft versions prior to 8.46 improperly validate TLS certificates from easyE4 devices, allowing a network-adjacent attacker to perform man-in-the-middle attacks. This vulnerability could enable interception or modification of communications between easySoft and easyE4 devices.
The Advanced Custom Fields: Extended WordPress plugin up to version 0.9.2.6 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete arbitrary media library attachments by submitting a crafted form with a numeric attachment ID, without verifying user ownership or capabilities. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action that includes a deletable attachment field bound to user input.
The Advanced Views – Display Framework for Gutenberg & Elementor WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 3.9.6. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. These scripts execute whenever a user accesses a page containing the injected comment, including pages displaying pending or unapproved comments due to lack of approval-status filtering.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
@fastify/express versions 4.0.5 through 4.0.8 contain a vulnerability where, if Fastify is configured with the non-default ignoreDuplicateSlashes option, path-scoped Express middleware may be bypassed. This occurs because Fastify's router normalizes duplicate slashes differently than Express when handling absolute-form request targets, allowing requests to reach scoped routes without passing through authentication or authorization middleware. The issue is fixed in version 4.0.9.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and certain LTS releases contain a stack-based buffer overflow vulnerability (CWE-121). This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixes are available in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
CVE-2026-41021 affects Eaton easyE4 versions prior to 2.46 and involves weak password requirements. This weakness allows an attacker who has obtained password hashes, potentially via another vulnerability (CVE-2026-41020), to perform offline password-guessing attacks and recover user credentials. The vulnerability is rated high severity with a CVSS score of 7.5. Eaton has fixed this issue in version 2.46.
Dell PowerProtect Data Domain versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
@fastify/session versions before 11.1.6 have a race condition vulnerability in the default rolling session behavior. This flaw allows an attacker who possesses a valid signed session cookie to replay that cookie across a logout event, restoring the session after it was intended to be destroyed. The issue arises because a request restoring a session before a logout can overwrite the destroyed session entry, effectively resurrecting the session without cookie theft or signature forgery. The vulnerability is fixed in version 11.1.6 by adding a per-session generation marker and conditional store writes to prevent session restoration or overwriting after logout.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, including several LTS releases, contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). This vulnerability allows an unauthenticated remote attacker to induce the server to make unintended requests. The issue is fixed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
The npm package '@azure-growth/signup-ux-components' version 1.2.2 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain linked to malicious activity. There is no CVSS score or detailed technical impact provided. No known exploits in the wild have been reported.
CVE-2026-102800 is a high-severity stored cross-site scripting (XSS) vulnerability in the DJ-HelpfulArticles extension for Joomla versions 1.0.0 through 1.2.0. The vulnerability arises from an unauthenticated voting widget that accepts a client-supplied 'ip' field via AJAX without proper output escaping. This field is stored and later rendered in the Joomla administrator backend without HTML escaping, enabling stored XSS attacks. The lack of CSRF tokens and rate limiting exacerbates the risk by allowing repeated exploitation.