Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

Out‑of‑Bounds Read Denial of Service in EIPStackGroup OpENer

EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing. This allows a remote attacker to cause a denial of service.

Opener v2.3 GetAttributeList Buffer Overflow Causes Remote Denial of Service

EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList() implementation for the EtherNet/IP Get_Attribute_List service. This allows a remote attacker to cause a denial of service

Local Out‑of‑Bounds Write in Samsung libsmkvextractor.so

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory.

Local Privilege Escalation via Improper Permission Handling in CmcCore

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs.

Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL

Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve the full title, content, image, tags, author and publish date because PostResource skips authorization and ViewPost ignores is_published.

Windows USB Print Driver Elevation of Privilege Vulnerability

Use after free in Windows USB Print Driver allows an authorized attacker to elevate privileges locally.

Improper Argument Injection Enabling Root-Level Command Execution in Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of argument delimiters in a command ('argument injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

OS Command Injection via Improper Neutralization in Dell PowerProtect Data Domain

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS command ('OS command injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to arbitrary command execution with root privileges.

XG VisionTerminal, XG-X VisionTerminal, LJ Series Terminal-Software and WI Series Terminal-Software provided by Keyence Corporation improperly restrict XML external entity references. If a user opens a specially crafted setting file, the sensitive information stored in the system where the affected product is installed may be disclosed.

Expired Pointer Dereference in EtherNet/IP CPF Handling Allows Remote Denial of Service

EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vulnerability in the EtherNet/IP Common Packet Format (CPF) handling logic. This allows a remote attacker to cause a denial of service.

Arbitrary Code Execution via Malicious task_id in iStoreOS

An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code via the task_id in tasks-lib.lua.

Insufficiently Protected Credentials in Rocket Remote Desktop 18.0.8583.1

Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credentials.

Improper Export of Android Application Components Enables Local Data Access

Improper export of android application components in Samsung Account prior to version 15.7.01.1 allows local attackers to access sensitive data.

Improper Authentication Enables Adjacent Attackers to Access Sensitive Data in Samsung Flow

Improper authentication in Samsung Flow prior to version 4.9.22.4 allows adjacent attackers to access sensitive information.

Dell PowerProtect Data Domain appliances, versions 7.7.1.0 through 8.6.0.0 and version 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper privilege management vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges to access unauthorized delete operation.

A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.

Windows Universal Disk Format File System Driver (UDFS) Information Disclosure Vulnerability

Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.

Windows Composite Image File System Elevation of Privilege Vulnerability

Use after free in Windows Composite Image File System allows an authorized attacker to elevate privileges locally.

ColdFusion | Incorrect Authorization (CWE-863)

ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.