NVIDIA TensorRT-LLM has a server-side request forgery (SSRF) vulnerability (CVE-2026-24269) that could allow an attacker to cause unauthorized server requests. Exploitation may lead to information disclosure and data tampering. The vulnerability has a high severity score of 7.1 (CVSS 3.1). No affected versions or patches are explicitly stated in the provided data.
NVIDIA TensorRT-LLM has a vulnerability identified as CVE-2026-65120 that allows an attacker to perform server-side request forgery (SSRF). Exploitation of this vulnerability could lead to information disclosure. The vulnerability has a high severity rating with a CVSS score of 7.1. No affected versions or patch information are currently provided.
A concurrency issue in @better-auth/drizzle-adapter and @better-auth/kysely-adapter when using PostgreSQL for rate-limit record storage can allow bursts of concurrent requests to exceed configured rate limits. This affects versions 1.6.17 up to but not including 1.7.7 for drizzle-adapter and up to but not including 1.7.0 for kysely-adapter. The flaw weakens rate limiting on sensitive endpoints like password sign-in and two-factor verification but does not bypass authentication or directly compromise accounts.
A critical vulnerability in better-auth versions from 1.4.0-beta.18 up to but not including 1.7.7 allows an unauthenticated attacker to use the OAuth state value as a Magic Link token to sign in as any user by knowing only their email address. This bypasses email verification and OAuth provider authentication, granting full session access. The flaw affects configurations using Magic Link with default or hashed token storage combined with social or Generic OAuth sign-in and database-backed OAuth state storage. The issue is fixed in version 1.7.7.
A missing authentication vulnerability in the 3D Viewer app for Nextcloud versions 1.7.9 through 3.3.1 allowed unauthorized access to password-protected shared 3D model files. The app's public file endpoint did not enforce share password checks, enabling anyone with a share token to retrieve the file contents without authentication. This issue affects only 3D file formats supported by the app and was fixed in version 3.3.2.
A vulnerability in the better-auth deviceAuthorization() plugin versions from 1.3.8-beta.3 up to, but not including, 1.7.0-rc.3 allows an attacker to trick a signed-in user into approving a device login request without showing the requesting client or requested permissions. This can lead to the attacker obtaining a live session token for the user. The issue is fixed starting with version 1.7.0-rc.3.
A vulnerability in Grav versions 1.7.53.3 through before 1.7.53.6 allows unauthorized access to sensitive profiler data via an authorization bypass in the Debugger component. Attackers can exploit a loopback REMOTE_ADDR fallback behind a same-host reverse proxy to read stored records, including administrator plaintext passwords and configuration credentials. This issue is fixed in version 1.7.53.6.
Google Guava versions from 4.0 up to but not including 33.7.2 contain a deserialization vulnerability in CompactHashMap, CompactHashSet, and MapMakerInternalMap. These classes read an attacker-controlled size value from a serialized stream without proper upper bound validation, leading to uncontrolled memory allocation. This can cause the Java Virtual Machine (JVM) to allocate multi-gigabyte arrays and crash with an OutOfMemoryError, even when the serialized data contains only a small number of actual elements.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and certain LTS releases contain a Relative Path Traversal vulnerability in the certificate handling. This flaw allows a high privileged attacker with remote access to potentially cause a denial of service condition. The vulnerability is identified as CWE-23 and has a CVSS 3.1 score of 6.5, indicating medium severity. Fixed versions are available starting from 7.13.1.80, 8.3.1.40, 8.6.1.20, and 8.9.0.0 respectively for the affected release lines.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and specific LTS releases contain a path traversal vulnerability (CWE-28). This flaw allows a high privileged local attacker to potentially cause denial of service. The vulnerability is fixed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and certain LTS releases contain a Relative Path Traversal vulnerability (CWE-23). This flaw allows a high privileged attacker with remote access to potentially tamper with information. The vulnerability has a low CVSS score of 3.8 and does not impact confidentiality but affects integrity and availability. Fixed versions are available starting from 8.9.0.0 and specific LTS patch versions.
MONAILabel server is vulnerable to a denial-of-service and silent inference corruption attack via crafted DICOM files exploiting pydicom's improper validation of Decimal String (DS) and Integer String (IS) values. An unauthenticated attacker can upload malicious DICOM files containing NaN or infinity values in spatial metadata fields, causing the server to crash or produce corrupted AI inference results. This affects MONAILabel versions prior to 1.6.1 and pydicom versions 0.9.7 through 3.0.2. The vulnerability arises because MONAILabel trusts pydicom output without validating these invalid values, and the REST API accepts uploads without authentication by default. A fix is available in MONAILabel 1.6.1.
CVE-2026-94347 is a Process Control vulnerability in Dell PowerProtect Data Domain Virtual Edition affecting multiple release versions. A high privileged attacker with remote access could exploit this flaw to bypass protection mechanisms. The vulnerability has a high severity with a CVSS score of 7.2. Fixed versions are available in later releases.
Dell PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7 and several LTS releases contain a path traversal vulnerability (CWE-31). This flaw allows a high privileged attacker with remote access to potentially execute arbitrary commands on the affected system. The vulnerability is rated high severity with a CVSS score of 7.2. Fixed versions are available starting from 7.13.1.80, 8.3.1.40, 8.6.1.20, and 8.9.0.0 or later.
Electrum versions before 4.7.2 contain a critical TOCTOU race condition vulnerability in the Nostr Wallet Connect plugin. This flaw allows malicious clients to bypass the daily spending limit by exploiting non-atomic budget checks and truncation of millisatoshi amounts. Attackers can send concurrent payment requests or repeatedly pay amounts that are rounded down, enabling them to drain funds beyond the intended limit. The issue is fixed in version 4.7.2.
Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by poisoning the Host header. Attackers send signed-in users authorization links using response_mode=form_post to capture codes, then redeem them via HTTP Basic client credentials to hijack back-office sessions and execute code through Razor templates.
Dell PowerProtect Data Domain versions 7.7.1.0 through LTS 2026, including specific LTS2024, LTS2025, and LTS2026 release versions, contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. The CVSS score is 4.9 (medium severity). No patch or remediation information is provided in the available data.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper access control vulnerability. This flaw allows an unauthenticated remote attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but can affect system availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 6.5, indicating a medium severity level.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw allows a high privileged attacker with local access to potentially elevate their privileges further. The vulnerability has a CVSS score of 6.3, indicating a medium severity impact. No public exploits or known active exploitation have been reported. No patch or remediation information is currently provided.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain an improper privilege management vulnerability. This flaw could allow a high privileged attacker with remote access to elevate their privileges. The vulnerability has a CVSS score of 6.7, indicating a medium severity level. No public exploits or known in-the-wild exploitation have been reported. Patch or remediation information is not provided in the available data.