Search: 5.1.8.7

A missing authorization vulnerability exists in iHomefinder, Inc.'s Optima Express software up to version 9.0.0. This flaw allows unauthorized network attackers to access functionality without proper access control, potentially leading to high confidentiality impact. The vulnerability is identified as CVE-2026-116393 with a CVSS 3.1 base score of 7.5, indicating high severity. No public exploits or patches are currently documented.

A SQL Injection vulnerability exists in BuddyPress up to version 14.5.2 due to improper neutralization of special elements in SQL commands. This flaw allows an attacker with low privileges to execute unauthorized SQL queries, potentially causing high confidentiality impact and limited availability impact without user interaction.

A vulnerability in Contact Form by Supsystic (up to version 1.10.5) allows insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data. The flaw is identified as CWE-201 and has a high severity with a CVSS score of 7.5. No patch or remediation details are provided in the available data.

Aman FunnelKit Automations wp-marketing-automations contains a critical Blind SQL Injection vulnerability (CVE-2026-111411) affecting versions up to 3.8.5.2. This flaw allows an unauthenticated attacker to execute SQL commands remotely without user interaction, potentially leading to high confidentiality impact and partial availability impact. No public exploits or known active exploitation have been reported. No patch information is currently available.

A race condition vulnerability exists in OpenVPN ovpn-dco-win versions 0.6.5 through 2.8.13 that allows unprivileged local users to cause a denial of service by crashing the system during the TCP connection process.

CVE-2026-116389 is a deserialization of untrusted data vulnerability in the crossi72 Phoenix Media Rename plugin, affecting versions up to 3.13.5. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 and requires low privileges to exploit without user interaction.

A CSV formula injection vulnerability exists in the registrations export feature of the Joomla extension iCagenda versions 3.5.0 through 4.0.16. This vulnerability allows malicious formulas to be injected into exported CSV files, potentially leading to unintended execution when the CSV is opened in spreadsheet software.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a vulnerability related to allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on availability. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the source data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access to the system. The vulnerability is identified as CWE-862 and has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. No public exploits or known exploitation in the wild have been reported. Patch or remediation details are not provided in the available data.

CVE-2026-105457 is a path traversal vulnerability in HAVELSAN Inc. Liman MYS versions before 2.3.5-1132. This flaw allows an attacker with low privileges to access restricted directories by manipulating pathnames. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

CVE-2026-118039 is an XML External Entity (XXE) vulnerability in Progress Software's Telerik Document Processing Libraries before version 2026.3.1027. The flaw exists in SVG image processing, where an unauthenticated attacker can exploit a crafted SVG image containing a nested embedded SVG to read local files on the server during image processing or PDF export. This vulnerability has a high severity score of 7.5 and allows unauthorized disclosure of sensitive information without requiring user interaction or privileges.

HCL BigFix AEX version 13.0.0.1 contains an information disclosure vulnerability due to improper handling of error messages. This flaw can reveal sensitive technical information such as stack traces, system details, or internal paths. Such disclosures may aid attackers in crafting further attacks. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No public exploits or patches are currently documented.

Red Hat has released a security advisory for kernel live patch modules targeting kernel-5.14.0-687.10.1.el9_8. The update addresses multiple vulnerabilities in the Linux kernel related to netfilter ebtables, pppoe header handling, bridge port group deletion, packet header length consistency, and xfrm ah6 routing header validation. These vulnerabilities have been rated as important by Red Hat Product Security. The advisory provides updated packages for Red Hat Enterprise Linux 9 and its variants.

CVE-2026-87879 is a vulnerability in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 involving improper verification of cryptographic signatures. This flaw leads to sensitive information disclosure due to improper token validation. The vulnerability has a CVSS 3.0 score of 5.9, indicating medium severity. A fix is available in build 42587.

Acronis Cyber Protect 17 (Linux and Windows) before build 42587 contains a cross-site scripting (XSS) vulnerability due to improper input validation. This flaw allows an attacker with high privileges and user interaction to execute malicious scripts, potentially compromising confidentiality and integrity. The vulnerability has a medium severity score of 5.7 and is fixed in build 42587.

CVE-2026-87097 is a vulnerability in Acronis Cyber Protect 17 (Linux and Windows) before build 42587 that involves insufficiently protected credentials, leading to sensitive information disclosure. The flaw is classified under CWE-522. The vulnerability has a CVSS 3.0 base score of 5.3, indicating medium severity. A fix is available in build 42587.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 and several LTS releases contain a path traversal vulnerability (CWE-22) that allows unauthenticated remote attackers to access the filesystem. This vulnerability is fixed in versions 8.9.0.0 or later, 8.6.1.30 or later, 8.3.1.50 or later, and 7.13.1.90 or later. The CVSS v3.1 base score is 5.3, indicating medium severity.