OAuthLib contains a vulnerability in its implementation of the OAuth 2.0 device authorization grant (RFC 8628). The token endpoint does not validate the 'device_code' parameter properly, allowing an attacker who knows a valid client ID enabled for the device workflow to obtain a bearer token without a valid device code. This affects OAuthLib versions starting from 10.7.0_3. The vulnerability can lead to unauthorized token issuance, impacting confidentiality and integrity of client sessions.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, including various LTS releases, contain a path traversal vulnerability (CWE-22). This flaw allows a low privileged attacker with remote access to potentially access the filesystem beyond intended restrictions. The vulnerability is rated high severity with a CVSS score of 8.8. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 respectively.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain an OS Command Injection vulnerability (CWE-78). This flaw allows a high privileged attacker with remote access to execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. Fixed versions are available starting from 8.9.0.0, 8.6.1.30, 8.3.1.50, and 7.13.1.90 depending on the release branch.
A vulnerability in virtualenv allows attacker-controlled prompt text to be interpreted as executable syntax in the bash activation prompt under certain older bash compatibility modes (4.2 and lower) and specific shell scenarios involving dash. This can lead to command execution when the environment is activated and the prompt is drawn. The issue affects POSIX activation scripts and arises when the prompt string is assigned to PS1 and later expanded by the shell. The vulnerability was introduced in virtualenv 20.0.0b1 and 21.14.7 and fixed in 21.14.8.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and specific LTS releases contain an improper authentication vulnerability (CWE-287). This flaw allows an unauthenticated remote attacker to execute arbitrary commands with root privileges. The vulnerability is critical with a CVSS score of 9.8. Dell has released fixed versions starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 onwards and recommends upgrading promptly.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially expose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and various LTS releases contain an authentication bypass vulnerability via spoofing. This flaw allows a low privileged remote attacker to potentially elevate privileges and impact other managed Data Domain systems. The vulnerability is identified as CWE-290 and has a critical CVSS score of 9.1. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 respectively.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain a SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a vulnerability involving improper validation of integrity check values. This flaw could allow a high privileged local attacker to bypass protection mechanisms. The vulnerability is tracked as CVE-2026-90720 with a CVSS score of 6.7, indicating a medium severity impact. Fixed versions are available starting from 8.9.0.0 and corresponding LTS patch levels.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a path traversal vulnerability (CWE-24). A highly privileged local attacker could exploit this flaw to cause a denial of service. The vulnerability does not impact confidentiality but may affect integrity and availability. Fixes are available in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and certain LTS releases contain an SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability (CWE-89). A high privileged attacker with remote access could exploit this flaw to disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
The npm packages @zmtcdn/ui versions 9999.0.0 and 9999.0.7 are malicious dependency-confusion packages that execute a postinstall script sending system environment details to an external server without user consent. The postinstall script collects hostname, username, platform, working directory, environment variable names, and a timestamp, then sends this data to https://www.hinny.shop/api. These packages were published by a suspicious npm account and have no legitimate functional purpose for this data transmission.
The Hustle plugin for WordPress versions up to 7.8.14.3 is vulnerable to stored cross-site scripting (XSS) via the 'content[cta_label]' parameter. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. By default, only administrators have the capability to edit modules, but this can be delegated to lower roles such as Subscribers, potentially allowing exploitation at lower privilege levels.
The Hustle plugin for WordPress versions up to 7.8.14.3 contains a stored cross-site scripting (XSS) vulnerability in the 'content[title]' parameter. This flaw allows authenticated users with custom-level access and the 'Create and Update Modules' capability granted via the plugin's permissions settings to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires explicit permission delegation by an administrator and is not enabled by default.
The Mage Eventpress plugin for WordPress, used for event booking management in WooCommerce, contains a privilege escalation vulnerability in versions up to and including 5.7.8. The vulnerability arises from the mep_grant_shop_manager_access() function, which improperly grants the manage_options capability based on an attacker-controlled request parameter without proper validation. This allows authenticated users with Shop Manager-level access or higher to escalate their privileges to Administrator by appending a crafted query parameter to admin URLs.
The Royal Addons for Elementor WordPress plugin versions prior to 1.7.1070 lack authorization checks when using stored Mailchimp credentials. This flaw allows unauthenticated attackers to add arbitrary email addresses and contact details as confirmed subscribers to the site owner's Mailchimp audience.
The Royal Addons for Elementor WordPress plugin versions before 1.7.1070 improperly handle access control for post content in non-public post types. Specifically, the plugin does not verify that a requested post is publicly viewable before returning its content via an unauthenticated AJAX action. This flaw allows unauthenticated users to access sensitive content such as captured contact-form submissions containing personal information.
The Persian WooCommerce SMS WordPress plugin versions before 7.3.2 contain a reflected cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly sanitize and escape a parameter before reflecting it into an HTML attribute. The vulnerability can be exploited when a logged-in privileged user is tricked into submitting a crafted cross-site request, leading to script execution in their browser session.
The Essential Addons for Elementor WordPress plugin versions before 6.8.7 contain a vulnerability that allows unauthenticated visitors to bypass restrictions on post type and meta queries to the pagination endpoint. This flaw could enable attackers to access content from non-public post types and retrieve values of private custom fields on published posts.