Search: 5.1.8.3

A deserialization of untrusted data vulnerability exists in weDevs Dokan dokan-lite up to version 5.3.1. This flaw allows object injection, potentially leading to high impact on confidentiality, integrity, and availability. The vulnerability is identified as CVE-2026-115590 with a CVSS 3.1 score of 7.2, indicating a high severity. No patch or remediation information is currently provided.

A missing authorization vulnerability exists in iHomefinder, Inc.'s Optima Express software up to version 9.0.0. This flaw allows unauthorized network attackers to access functionality without proper access control, potentially leading to high confidentiality impact. The vulnerability is identified as CVE-2026-116393 with a CVSS 3.1 base score of 7.5, indicating high severity. No public exploits or patches are currently documented.

A race condition vulnerability exists in OpenVPN ovpn-dco-win versions 0.6.5 through 2.8.13 that allows unprivileged local users to cause a denial of service by crashing the system during the TCP connection process.

CVE-2026-116389 is a deserialization of untrusted data vulnerability in the crossi72 Phoenix Media Rename plugin, affecting versions up to 3.13.5. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 and requires low privileges to exploit without user interaction.

Three TLS vulnerabilities were disclosed in the GoAhead web server used in hundreds of millions of devices across IoT, OT, firewall, and military sectors. The critical flaw (CVE-2026-115881) affects versions 3.4.5 through 6.1.0 built with OpenSSL or compatible libraries configured for mutual TLS with certificate revocation lists, allowing revoked certificates to be accepted. Another flaw affects versions 4.0.2 through 6.1.0 built with Mbed TLS, weakening encryption of some TLS 1.2 connections and enabling offline decryption of recorded sessions if clients accept flawed parameters. A third flaw (CVE-2026-115884) impacts versions up to 6.1.0 built with LibreSSL 3.2.x or 3.3.2 through 3.3.6, bypassing certificate chain length limits under certain configurations. GoAhead 6.1.1 fixes the OpenSSL and Mbed TLS issues, and mitigations exist for the LibreSSL issue. The availability of upstream fixes does not guarantee device patches, which depend on manufacturers.

CVE-2026-111850 is a SQL Injection vulnerability in BuddyPress versions prior to 14.5.3. It involves improper neutralization of special elements in SQL commands, allowing an attacker with low privileges to execute unauthorized SQL queries. The issue is fixed in version 14.5.3.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Blind SQL Injection.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

A missing authorization vulnerability exists in the wphocus My auctions allegro my-auctions-allegro-free-edition plugin, affecting versions up to 4.0.3. This flaw allows attackers with limited privileges to bypass access controls, potentially leading to unauthorized information disclosure or modification. The vulnerability is identified as CWE-862 and has a CVSS v3.1 base score of 5.4 (medium severity). No patch or official remediation has been indicated in the available data.

A CSV formula injection vulnerability exists in the registrations export feature of the Joomla extension iCagenda versions 3.5.0 through 4.0.16. This vulnerability allows malicious formulas to be injected into exported CSV files, potentially leading to unintended execution when the CSV is opened in spreadsheet software.

A cross-site scripting (XSS) vulnerability exists in Acronis Cyber Protect 17 (Linux, Windows) before build 42587 due to improper input validation. This vulnerability could allow an attacker with high privileges and user interaction to execute malicious scripts, potentially compromising confidentiality and integrity. The vulnerability has a CVSS 3.0 score of 5.7, indicating medium severity.

A link following vulnerability exists in the Data Shredder components of Norton Antivirus, Avast Antivirus, and AVG Internet Security on Windows versions prior to 26.5.10933. This vulnerability allows a local, low-privileged attacker to escalate privileges to SYSTEM by exploiting the shred operation to delete arbitrary files or folders.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a vulnerability related to allocation of resources without limits or throttling. This flaw could allow an unauthenticated remote attacker to cause a denial of service condition. The vulnerability has a CVSS 3.1 base score of 5.3, indicating a medium severity impact focused on availability. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the source data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) contain a Missing Authorization vulnerability. This flaw allows a low privileged attacker with remote access to potentially gain unauthorized access to the system. The vulnerability is identified as CWE-862 and has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality. No public exploits or known exploitation in the wild have been reported. Patch or remediation details are not provided in the available data.

Dell PowerProtect Data Domain versions 7.7.1.0 through 8.8, and specific LTS2024, LTS2025, and LTS2026 release versions contain a path traversal vulnerability. This flaw allows an unauthenticated remote attacker to potentially access the filesystem. The vulnerability is identified as CWE-22 and has a CVSS 3.1 base score of 5.3, indicating medium severity. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the available data.

CVE-2026-105457 is a path traversal vulnerability in HAVELSAN Inc. Liman MYS versions before 2.3.5-1132. This flaw allows an attacker with low privileges to access restricted directories by manipulating pathnames. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact primarily affecting confidentiality without impacting integrity or availability.

CVE-2026-118039 is an XML External Entity (XXE) vulnerability in Progress Software's Telerik Document Processing Libraries before version 2026.3.1027. The flaw exists in SVG image processing, where an unauthenticated attacker can exploit a crafted SVG image containing a nested embedded SVG to read local files on the server during image processing or PDF export. This vulnerability has a high severity score of 7.5 and allows unauthorized disclosure of sensitive information without requiring user interaction or privileges.

HCL BigFix AEX version 13.0.0.1 contains an information disclosure vulnerability due to improper handling of error messages. This flaw can reveal sensitive technical information such as stack traces, system details, or internal paths. Such disclosures may aid attackers in crafting further attacks. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. No public exploits or patches are currently documented.

Red Hat has released a security advisory for kernel live patch modules targeting kernel-5.14.0-687.10.1.el9_8. The update addresses multiple vulnerabilities in the Linux kernel related to netfilter ebtables, pppoe header handling, bridge port group deletion, packet header length consistency, and xfrm ah6 routing header validation. These vulnerabilities have been rated as important by Red Hat Product Security. The advisory provides updated packages for Red Hat Enterprise Linux 9 and its variants.