CVE-2026-105323 is a reflected cross-site scripting (XSS) vulnerability in Kulga News Software versions from 26.7.4 up to but not including 26.10.0. This flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS 3.1 score of 6.1, indicating a medium severity impact primarily affecting confidentiality and integrity with no impact on availability. A fix is available in version 26.10.0.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and several LTS releases contain an improper privilege management vulnerability (CWE-269). A high privileged attacker with remote access could exploit this flaw to elevate their privileges. The vulnerability has a CVSS score of 6.7, indicating medium severity. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
Eclipse ioFog Operator versions 3.8.0 up to but not including 3.9.2 disable TLS certificate verification when communicating with the Controller API and logging into an external OIDC issuer. This improper certificate validation allows an on-path attacker to present any certificate, potentially capturing sensitive credentials such as the OAuth client secret or the Controller bootstrap admin password. The vulnerability was fixed in version 3.9.2.
Eaton easySoft versions prior to 8.46 improperly validate TLS certificates from easyE4 devices, allowing a network-adjacent attacker to perform man-in-the-middle attacks. This vulnerability could enable interception or modification of communications between easySoft and easyE4 devices.
The Advanced Custom Fields: Extended WordPress plugin up to version 0.9.2.6 contains an authorization bypass vulnerability. This flaw allows unauthenticated attackers to delete arbitrary media library attachments by submitting a crafted form with a numeric attachment ID, without verifying user ownership or capabilities. Exploitation requires a site administrator to have configured a public-facing ACFE form with an Email action that includes a deletable attachment field bound to user input.
The Advanced Views – Display Framework for Gutenberg & Elementor WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 3.9.6. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. These scripts execute whenever a user accesses a page containing the injected comment, including pages displaying pending or unapproved comments due to lack of approval-status filtering.
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.
@fastify/express versions 4.0.5 through 4.0.8 contain a vulnerability where, if Fastify is configured with the non-default ignoreDuplicateSlashes option, path-scoped Express middleware may be bypassed. This occurs because Fastify's router normalizes duplicate slashes differently than Express when handling absolute-form request targets, allowing requests to reach scoped routes without passing through authentication or authorization middleware. The issue is fixed in version 4.0.9.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7 and certain LTS releases contain a stack-based buffer overflow vulnerability (CWE-121). This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixes are available in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
CVE-2026-41021 affects Eaton easyE4 versions prior to 2.46 and involves weak password requirements. This weakness allows an attacker who has obtained password hashes, potentially via another vulnerability (CVE-2026-41020), to perform offline password-guessing attacks and recover user credentials. The vulnerability is rated high severity with a CVSS score of 7.5. Eaton has fixed this issue in version 2.46.
Dell PowerProtect Data Domain versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, and LTS2026 release versions 8.6.1.0 through 8.6.1.20 contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service condition. The vulnerability does not impact confidentiality or integrity but affects availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 or later.
@fastify/session versions before 11.1.6 have a race condition vulnerability in the default rolling session behavior. This flaw allows an attacker who possesses a valid signed session cookie to replay that cookie across a logout event, restoring the session after it was intended to be destroyed. The issue arises because a request restoring a session before a logout can overwrite the destroyed session entry, effectively resurrecting the session without cookie theft or signature forgery. The vulnerability is fixed in version 11.1.6 by adding a per-session generation marker and conditional store writes to prevent session restoration or overwriting after logout.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.7, including several LTS releases, contain a Server-Side Request Forgery (SSRF) vulnerability (CWE-918). This vulnerability allows an unauthenticated remote attacker to induce the server to make unintended requests. The issue is fixed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later.
CVE-2026-102800 is a high-severity stored cross-site scripting (XSS) vulnerability in the DJ-HelpfulArticles extension for Joomla versions 1.0.0 through 1.2.0. The vulnerability arises from an unauthenticated voting widget that accepts a client-supplied 'ip' field via AJAX without proper output escaping. This field is stored and later rendered in the Joomla administrator backend without HTML escaping, enabling stored XSS attacks. The lack of CSRF tokens and rate limiting exacerbates the risk by allowing repeated exploitation.
CVE-2026-41020 is an authentication bypass vulnerability in Eaton easyE4 devices caused by the use of a static nonce during authentication. This flaw allows an unauthenticated attacker who has captured valid authentication traffic to replay it and gain unauthorized access to the device. The vulnerability affects versions prior to 2.46. A fix is available in version 2.46. The vulnerability has a high severity rating with a CVSS score of 7.5.
CVE-2026-4337 is a high-severity vulnerability in the PuMuKIT application that allows unauthenticated users to upload files of any type to the server. The vulnerability permits uploads to any location where the web server user has write permissions, potentially enabling file deletion as well. This unrestricted file upload flaw can lead to significant security risks including unauthorized file manipulation.
svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection.
A denial of service vulnerability exists in darylldoyle svg-sanitizer versions from 0.5.3 up to but not including 1.1.0. The issue occurs in the Sanitizer::sanitize() function, which repeatedly rescans the entire input while stripping PHP tags. This inefficient algorithmic complexity allows unauthenticated attackers to craft SVG files with many overlapping PHP tag openers and closers, causing excessive CPU usage and service disruption.
CVE-2026-117539 is a cross-site scripting (XSS) vulnerability in darylldoyle svg-sanitizer versions before 1.0.0. The flaw allows attackers to embed external resources by uploading crafted SVG files that contain unsanitized style content, unquoted url() values, or image href attributes. This can lead to exfiltration of page data, user tracking, or disclosure of visitor IP addresses.
REDAXO core versions before 5.21.0 have a reflected cross-site scripting (XSS) vulnerability in the backend packages API. The flaw arises because a function parameter is concatenated into an error message without proper HTML escaping. An attacker can exploit this by tricking an authenticated backend user into clicking a crafted link containing a valid CSRF token, leading to JavaScript execution that can perform same-origin actions or read DOM data. This vulnerability is fixed in version 5.21.0.