Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service. The vulnerability does not impact confidentiality or integrity. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 4.9 (medium severity).
An OS command injection vulnerability in a CoreTec product allows authenticated users with certain roles to execute arbitrary system commands. The flaw is in the configuration daemon's time synchronization handler, which unsafely concatenates user input when setting the system time-zone. This can lead to full control over the affected device. The vulnerability has a high severity score of 7.7 and requires authentication with limited privileges. No patch or remediation details are currently provided.
Eaton easyE4 devices implement an insufficiently strong password policy. This weakness allows an attacker who obtains password hashes, potentially via related vulnerabilities such as CVE-2026-41020, to conduct offline password-guessing attacks and possibly recover user credentials. The vulnerability is rated high severity with a CVSS score of 7.5.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability allows an unauthenticated remote attacker to potentially perform SSRF attacks against the server.
Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1 contain a vulnerability where the provisioning key and CA certificate returned by the Controller API are concatenated into shell commands executed on remote agent hosts. An attacker able to modify the API response can inject shell metacharacters, causing arbitrary command execution on the agent host when the operator deploys or attaches an agent. This issue is fixed in version 3.9.2.
TRO600 has an arbitrary file read vulnerability that allows an unauthenticated attacker to read or download arbitrary files on the device, including sensitive configuration and password data. This leads to disclosure of sensitive information. The vulnerability is rated high severity with a CVSS score of 8.7. No affected versions or patch information are provided.
A reflected cross-site scripting (XSS) vulnerability exists in Kulga News Software versions from 26.7.4 up to but not including 26.10.0. This flaw is due to improper neutralization of input during web page generation, which can lead to the execution of malicious scripts in a user's browser. The vulnerability has a medium severity rating with a CVSS score of 6.1.
In certain versions of Octopus Server, creating a user invitation causes the invitation code to be logged in the audit event log. If the invitation is linked to a space, users with appropriate permissions in that space could read the invitation code from the audit log. An attacker who redeems the unclaimed invitation might escalate privileges depending on the permissions assigned to the invited user. This vulnerability has a high severity rating with a CVSS score of 7.7.
JetBrains Junie CLI versions prior to 26.8.17 contain a vulnerability that allows command execution due to incomplete validation of allowlisted commands. This flaw could enable an attacker with limited privileges to execute arbitrary commands. The issue has been assigned CVE-2026-117530 and carries a CVSS score of 6.7, indicating a medium severity level.
SemanticMediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious markup via the search parameter in the extended Special:Search profile. The vulnerability arises because the ProfileForm::profile_sheet function inserts unescaped user input into a pre element, enabling script execution in the context of the wiki origin when crafted URLs with SVG event handlers are used.
SemanticMediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious script via Code-typed property values. The vulnerability arises because attackers can embed HTML markup inside a valid JSON value, which is then rendered unescaped on the Special:Browse page, leading to JavaScript execution in the browsers of users viewing the page.
SemanticMediaWiki versions from 4.2.0 up to but not including 7.2.1 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious HTML and execute scripts in users' browsers via crafted URLs targeting the Special:FacetedSearch page. The vulnerability arises from unescaped cstate parameters that break out of hidden input attributes. The CVSS 3.1 base score is 6.1, indicating a medium severity issue.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.0 have a missing authorization vulnerability in the api.php smwtask module. This flaw allows unauthenticated attackers to perform admin-only maintenance tasks by leveraging the public anonymous CSRF token. Exploitation can lead to reading internal store statistics, enqueuing jobs such as smw.entityIdDisposer, and executing these jobs, which may degrade system performance and alter semantic data.
SemanticMediaWiki versions from 3.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with the smw-schemaedit permission to inject malicious script code via the canonical_name property of a property group schema. The injected script is rendered unescaped in Special:Browse headings by GroupFormatter, leading to JavaScript execution in the context of viewers, including administrators.
Semantic MediaWiki versions from 4.2.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with profile or schema editing permissions to inject malicious HTML through FacetedSearch exploration-link labels. The injected markup is passed unescaped to the page rendering function, potentially enabling script execution in the browsers of users viewing the affected Special:FacetedSearch page.
Semantic MediaWiki versions from 2.5.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious scripts via External identifier property values. The injected scripts are rendered unescaped on the Special:Browse page, enabling execution of JavaScript in the context of viewers' sessions, including administrators. The vulnerability has a medium severity rating with a CVSS score of 5.4.
SemanticMediaWiki versions from 5.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability in the ext.smw.tooltip.tippy.js component. This vulnerability arises because data-* attributes are rendered via innerHTML with allowHTML enabled, allowing editors to inject malicious JavaScript through specially crafted .smw-highlighter spans. When other users, including administrators, hover over these elements, the malicious script executes.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated users with the smw-schemaedit permission to inject malicious HTML code via schema descriptions. The injected HTML is rendered unescaped, enabling alteration of pages and potential targeting of users who view the affected schema pages.
Semantic MediaWiki versions from 3.0.0 up to but not including 7.3.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with page-edit rights to inject malicious HTML via Keyword-typed property values that are rendered without proper escaping on the Special:Browse page. Exploitation can lead to execution of JavaScript in the context of other users' sessions, including administrators, potentially enabling token theft and unauthorized actions.
Semantic MediaWiki versions from 3.1.0 up to but not including 7.3.1 contain a reflected cross-site scripting (XSS) vulnerability in the Special:SMWAdmin ID lookup feature. This vulnerability allows unauthenticated attackers to inject malicious markup via the unescaped 'id' parameter. By tricking an administrator into clicking a crafted link, attackers can bypass the auto-satisfied edit-token check and execute scripts within the administrator's session, potentially performing privileged actions.