Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Path Traversal vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8 and several LTS releases contain an SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0 depending on the release line.
Dell PowerProtect Data Domain Management Center versions 7.7.1.0 through 8.8, including several LTS releases, contain a SQL Injection vulnerability (CWE-89). This flaw allows a high privileged remote attacker to potentially disclose information. The vulnerability has a low CVSS score of 2.7 and does not impact integrity or availability. Fixed versions are available starting from 7.13.1.90, 8.3.1.50, 8.6.1.30, and 8.9.0.0.
The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field inside group — field id controlled by integrator config)' parameter in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when a site integrator renders the plugin's documented front-end form helper with a wysiwyg field inside a repeatable group on a publicly accessible page.
Multiple fraudulent websites impersonating legitimate Korean companies such as Doosan Robotics and Cheonjeong have been discovered. These sites use authentic corporate branding and offer features like invitation-code registration, VIP memberships, and cryptocurrency deposit/withdrawal functions. They instruct victims to make USDT payments via TRON wallet addresses and submit transaction screenshots. Analysis identified TRON wallets with significant transaction volumes, including one with approximately 13 million USDT received. Infrastructure tracking linked these domains to the ValleyRAT malware command and control IP address, but no direct operational connection between ValleyRAT malware and the fraudulent websites or wallets has been confirmed.
CVE-2026-16491 is a missing authorization vulnerability in Grafana Enterprise's RBAC service. It causes the system to ignore the requested folder when verifying folder administrator status for deleted dashboard listings. As a result, users with dashboard permission-management rights on any folder could be mistakenly treated as administrators of all folders, potentially exposing deleted dashboard items from folders where they lack administrative access. The issue affects multiple versions of Grafana Enterprise 13.0.0 through 13.1.1. A fix requires proper permission checks on the specified folder, its ancestors, or a wildcard scope.
A prototype pollution vulnerability exists in the systeminformation library for node.js versions prior to 5.33.13. On FreeBSD, OpenBSD, and NetBSD, the networkStats(ifaces) function improperly indexes cached network interface data using sanitized caller-controlled names, allowing Object.prototype properties to be overwritten. This can corrupt application logic such as branching, serialization, configuration merging, validation, or lookup behavior. The issue is fixed in version 5.33.13.
CVE-2026-108141 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who can control a backed-up NAS share, to write files to arbitrary paths on the backup server via relative path traversal. This flaw affects versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. The vulnerability has a medium severity with a CVSS score of 5.9. Fixed versions are 13.0.3 and 13.1.2.
CVE-2026-107671 is a high-severity vulnerability in Veeam ONE versions 13.1 through 13.1.0.7233 that allows an attacker with valid Administrator credentials to bypass multi-factor authentication (MFA). The attacker can disable MFA globally before completing the MFA verification process, effectively circumventing this security control.
CVE-2026-108142 is a critical vulnerability in Veeam Backup and Replication affecting versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. It allows an unauthenticated attacker to bypass authorization on the CDP Coordinator Service due to a failing open authorization check (CWE-636). The vulnerability has a high CVSS 4.0 score of 9.1, indicating network exploitable with no user interaction required and high impact on confidentiality, integrity, and availability. Fixed versions 13.0.3 and 13.1.2 address this issue. No known exploits in the wild have been reported.
CVE-2026-108140 is a path traversal vulnerability in Veeam Backup and Replication that allows an authenticated user with the Restore Operator role, who can control backed-up NAS share contents, to write files to arbitrary paths on the backup server. This flaw affects versions 13.0 up to but not including 13.0.3 and 13.1 up to but not including 13.1.2. The vulnerability is fixed in versions 13.0.3 and 13.1.2.
CVE-2026-105477 is a local privilege escalation vulnerability in Veeam Agent for Linux versions 13.1 up to but not including 13.1.2. It affects only installations managed by a Veeam Backup & Replication instance. The issue is due to an untrusted search path (CWE-426), which could allow an attacker with local access to escalate privileges.
Authlib versions from 0.13 up to 1.7.2 contain a vulnerability in the is_secure_transport() function, which incorrectly treats certain HTTP URLs with userinfo components as secure loopback addresses. This allows an attacker to bypass the TLS enforcement by crafting URLs like http://localhost:80@evil.example/cb, where the actual host is external but the function returns true due to a prefix string match. This flaw affects OAuth 2.0 / OIDC endpoint and redirect URI validation, potentially allowing cleartext HTTP URLs to be accepted where TLS is required. The issue is fixed in Authlib 1.8.0.
PowerProtect Data Domain Virtual Edition versions 7.7.1.0 through 8.7, and multiple LTS releases including 7.13.1.0 through 7.13.1.70, 8.3.1.0 through 8.3.1.30, and 8.6.1.0 through 8.6.1.10, contain a process control vulnerability. This flaw could allow a high privileged attacker with remote access to bypass protection mechanisms. The vulnerability has a CVSS 3.1 score of 7.2, indicating high severity.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a path traversal vulnerability. This flaw allows a highly privileged local attacker to potentially cause a denial of service. The vulnerability does not impact confidentiality but affects integrity and availability.
PowerProtect Data Domain versions 7.7.1.0 through 8.7, including certain LTS2024, LTS2025, and LTS2026 releases, contain a Relative Path Traversal vulnerability in the certificate handling. This flaw allows a high privileged attacker with remote access to potentially cause a denial of service condition. The vulnerability has a CVSS score of 6.5, indicating medium severity. No public exploits or patches are currently documented.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a stack-based buffer overflow vulnerability. This flaw could be exploited by a high privileged attacker with remote access to cause a denial of service. The vulnerability does not impact confidentiality or integrity but affects availability. No public exploits or known active exploitation have been reported. The CVSS v3.1 base score is 4.9, indicating medium severity.
Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Relative Path Traversal vulnerability. This flaw could allow a high privileged attacker with remote access to tamper with information. The vulnerability has a low CVSS score of 3.8 and does not impact confidentiality but affects integrity and availability. No public exploits or known active exploitation have been reported. No patch or remediation details are provided in the available data.
CVE-2026-92377 is a high-severity vulnerability in TeamViewer Full Client and Host for Windows prior to version 15.82. It involves improper access control in the Patch Management update mechanism, allowing a local authenticated attacker with low privileges to execute arbitrary code with SYSTEM privileges by supplying a signed executable through a forged IPC response. The issue is fixed in versions 15.82, 15.64.10 (Legacy Windows 7 & 8), 14.7.48868, and 13.2.36231.
Nodemailer versions from 3.0.0 up to but not including 10.0.13 contain a vulnerability in the SMTP client where certain regular expressions used to detect SMTP AUTH mechanisms cause quadratic backtracking. This leads to a denial of service by blocking the Node.js event loop during the EHLO response parsing if the server returns a crafted response with long whitespace runs and no matching mechanism. The vulnerability can be triggered pre-authentication by an attacker controlling or influencing the SMTP server or man-in-the-middling the connection before STARTTLS. A fix is available in Nodemailer version 10.0.13.