SQL injection in Dell PowerProtect Data Domain Management Center lets a low-privileged authenticated user read data they should not be able to access, with no integrity or availability impact. Affected builds are Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, and LTS2026 8.6.1.0 through 8.6.1.20. No public exploit code or confirmed active exploitation was identified at time of analysis; this is a moderate-severity, lower-priority issue rather than an urgent emergency, with the main prerequisite being that the attacker already holds valid credentials on the management appliance.
Limited arbitrary media file deletion affects the WordPress plugin AI Engine - MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini in all versions up to and including 3.8.4. An authenticated attacker holding only subscriber-level access can abuse insufficient path validation in the plugin's upload_file function to target media files outside the intended upload location, but three prerequisites must align: the administrator must have explicitly enabled the plugin's non-default Public API option, and the plugin's scheduled hourly cleanup_files task must run after the malicious upload before the deletion takes effect. Wordfence rates this Medium (CVSS 4.2, AC:H) with impact limited to integrity and availability of media files and no confidentiality exposure; no public exploit code has been identified at time of analysis, and the issue is not in CISA KEV.
Server-side request forgery in HCL BigFix AEX lets an authenticated low-privilege user induce the application to send requests to external resources, which could expose limited information or enable limited unauthorized actions against reachable services. The flaw is rated CVSS 4.2 with high attack complexity and no availability impact, and the supplied intelligence assigns it a this-month remediation priority. No public exploit code or CISA KEV confirmation is present in the supplied data, and exploitation requires a valid low-privilege session rather than being an unauthenticated default-configuration attack.
Improper control of code generation (CWE-94) in Dell iDRAC Service Module (iSM) versions prior to 6.1.1.0 for Windows, Linux, and ESXi lets a high-privileged local attacker inject code and elevate privileges on the host. Because exploitation requires an attacker to already hold administrator or root-level access on the managed server, the flaw is primarily a post-compromise concern rather than a remotely reachable entry point; CVSS is 4.2 (AV:L/PR:H). No public exploit is identified in the available data and the issue is not in CISA KEV, so remediation should be scheduled through normal patch cycles.
Authenticated SQL injection in the Customer Engagement System WordPress plugin before 2.0.2 lets a WordPress administrator read database contents by supplying unsanitized popup page and category ID values that are concatenated into an INSERT statement. The assessed vector requires a high-privileged administrator (PR:H), which sharply limits the realistic attacker population because administrators already have broad database access, and the issue is rated low priority. EPSS is 0.18% (7th percentile), the vuln.today decision label is this_month, and no public exploit identified at time of analysis.
Apache Qpid Proton C through 0.40.0, when built against OpenSSL, treats the application-supplied trust store as an addition to the host's default system trust anchors rather than as a replacement. Applications that call pn_ssl_domain_set_trusted_ca_db() or pn_tls_config_set_trusted_certs() to narrow trust to a specific CA therefore silently continue to trust every CA in the operating system store, so an attacker positioned to intercept the TLS connection could present a certificate chaining to any of those residual roots and be accepted for the targeted peer identity. The Win32 SChannel backend is unaffected, the scope of abuse is a trust-scope bypass rather than code execution, and an attacker also needs a man-in-the-middle position. No CVSS vector, EPSS score, KEV entry, or public exploit code was provided at time of analysis; the upstream JIRA issue is marked Resolved/Fixed with fix version proton-c-0.41.1.
Kafka Connect workers leak plaintext secrets through the REST API's /connector-plugins/{connector-type}/config/validate endpoint, which resolves Configuration Provider variables and returns the resolved values in its response, so anyone who can reach the endpoint can read credentials that were meant to stay hidden until runtime. Deployments are affected from Kafka 2.4.0 up to but not including 4.2.2, and from 4.3.0 up to but not including 4.3.2; the vendor fixed the behaviour in 4.2.2, 4.3.2 and 4.4.0. The request path requires no credentials (the assessed CVSS vector is AV:N/AC:L/PR:N/UI:N, and the Connect REST API has no authentication enabled by default), though disclosure is bounded to secrets that the Configuration Providers actually configured on that worker can resolve; no public exploit code, CISA KEV listing, or EPSS score was identified at time of analysis.
CVE-2026-117622 (Jenkins SECURITY-4249) cannot be fully assessed from the supplied data because the oss-security description is truncated at 'To protect against deserialization vulnerabilities, Jenkins restricts th…'; the exact defect, trigger, required permissions, and impact are not stated. Jenkins core is the affected product, and the 2026-10-28 Jenkins advisory lists Jenkins 2.588 and Jenkins LTS 2.580.2 as releases containing fixes. No CVSS vector, CWE, EPSS, KEV status, or confirmed public exploit information is provided; the priority decision is awaiting_data and no public exploit is identified at time of analysis.
Apache Kafka brokers can be driven into heap exhaustion by any authenticated client because the PushTelemetry (KIP-714) path limits the compressed request size but not the decompressed output. A tiny, highly compressible payload can expand to hundreds of megabytes, and repeated or concurrent requests can trigger OutOfMemoryError, degrade brokers, and affect cluster availability; PushTelemetry is not ACL-gated. No public exploit was identified at time of analysis, and vendor fixes are available in Apache Kafka 4.2.2, 4.3.1, and 4.4.0.
Apache Kafka brokers that authenticate clients via SASL/OAUTHBEARER using the bundled JWKS-backed validator can accept a validly-signed JWT that was minted by a different issuer, or that omits the aud claim, because the issuer check only runs when sasl.oauthbearer.expected.issuer is set and an audience claim is only required when sasl.oauthbearer.expected.audience is set - both default to unset. The practical exposure is concentrated in deployments whose JWKS endpoint publishes signing keys for more than one issuer (multi-tenant IdP, aggregated/shared JWKS, shared signing keys), where such a token may authenticate a client, potentially as a higher-privileged principal; single-issuer deployments that control the iss claim and issue audience-scoped tokens are far less exposed. The JWT signature trust anchor is still enforced in every case, no public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; an analyst-derived CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N places severity at the high end while acknowledging the configuration and token-availability preconditions.
CVE-2026-116267 is a flaw tracked in the Ubuntu ecosystem for which the available intelligence contains no description, no CWE classification, no CVSS score or vector, and no identified package or version range. Because severity, trigger conditions, and authentication requirements are all unrecorded, the practical impact on any given Ubuntu deployment cannot be scoped from the supplied data, and risk cannot be meaningfully quantified. There is no KEV listing and no public exploit identified at time of analysis; the vuln.today priority label places it in the 'this_month' remediation bucket rather than an immediate-action tier.
CVE-2026-116264 has no published description, CVSS vector, CWE classification, or affected-version data in the supplied intelligence, so the vulnerable component and attack mechanism cannot be identified. The record is attributed to Ubuntu vendor reporting and is prioritized as this_month by vuln.today. No public exploit has been identified at time of analysis, and authentication requirements are not confirmed from available data.
CVE-2026-116269 is a security flaw in an Ubuntu-maintained package, reported through the Ubuntu security tracker, but the supplied sources carry no description, no CVSS score or vector, no CWE classification, no CPE data and no exploit or proof-of-concept references. Because the affected component, the trigger condition and the required privileges are all unknown, risk cannot be meaningfully quantified from the supplied data, and the vuln.today priority decision label of 'this_month' is currently the only prioritisation signal available. Tracking the corresponding Ubuntu Security Notice for the affected package is the required next step to establish impact and exploitation preconditions.
CVE-2026-110928 cannot be characterized beyond its identifier: the available intelligence contains no description, no CVSS vector, no CWE, no CPE data and no named affected product or version, so the impact an attacker could achieve is unknown. The only attribution is a report from the vendor:ubuntu source, which places this item in the vuln.today 'this_month' priority bucket, a scheduling signal rather than a statement about severity. No CISA KEV listing is present, no EPSS score is available, and no public exploit identified at time of analysis; the exploitation trigger and any prerequisites are not described in the available sources, so real-world risk cannot be meaningfully assessed until the Ubuntu advisory is obtained.
Ubuntu packages are affected by CVE-2026-116270, but the source data supplied here contains no description, no CVSS score or vector, no CWE classification, no CPE identifiers, and no reference URLs, so the vulnerable component and the achievable impact cannot be stated. The only substantive signal is the reporter, the Ubuntu vendor source, together with a vuln.today priority of this_month, which places the issue outside immediate-response triage but inside the current monthly remediation window. No KEV listing, no EPSS score, and no public exploit reference were provided, and no public exploit was identified at time of analysis; risk cannot be meaningfully quantified from the supplied data, and the Ubuntu Security Notice or Ubuntu CVE tracker entry must be retrieved to identify the affected source package, the fixed version, and the triggering conditions.
CVE-2026-116268 is an entry reported by the Ubuntu vendor channel that carries no description, no CWE mapping, no CVSS score and no CVSS vector in the supplied intelligence, so the vulnerability class and attack surface cannot be established from the available data. The record is attributed only to Ubuntu, and the specific package, version range and deployment mode that are affected must be read from the corresponding Ubuntu Security Notice before any exposure assessment is possible. Exploitation prerequisites remain unconfirmed: authentication requirements are not confirmed from available data, no public exploit code or PoC reference was supplied, and the priority assigned by vuln.today is this_month rather than an emergency or act_now decision, so risk cannot be meaningfully quantified from the supplied data.
Ubuntu Linux risk for CVE-2026-116271 is unassessable from the available intelligence because no description, CVSS score or vector, CWE, affected package, or version range is supplied. The only context is the vendor attribution to Ubuntu, so impact, prerequisites, and attack surface cannot be determined. No public exploit has been identified at time of analysis, and the vuln.today priority is this_month.
CVE-2026-116265 is attributed to Ubuntu by the vendor reporting source, but the supplied intelligence contains no description, CVSS vector, CWE, affected package, version range, or advisory reference. As a result, the impact, attack prerequisites, and affected deployments cannot be determined, and the risk cannot be meaningfully quantified from the available data. No KEV, PoC, EPSS, or patch status information was provided, so exploitation status is unknown; consult the Ubuntu advisory for the affected source package and fixed version.
CVE-2026-116273 is an entry in the Ubuntu ecosystem reported by the vendor (vendor:ubuntu) with a vulnerability-management priority of 'this_month', but the record supplied to this analysis carries no description, no CVSS vector, no CWE classification, and no CPE data. Because neither the affected Ubuntu package nor the trigger condition is documented in the available sources, the impact an attacker could achieve, the access level required, and the deployment preconditions all remain undetermined; no public exploit code has been identified at time of analysis, and no EPSS score is available. Risk cannot be meaningfully quantified from the supplied data and must be re-assessed once the corresponding Ubuntu Security Notice is retrieved.
CVE-2026-115683 currently exists in the supplied intelligence only as an entry reported by the Ubuntu vendor source (Ubuntu CVE tracker), carrying a vuln.today priority decision label of this_month; the advisory description is '[Unknown description]' and no CVSS score, CVSS vector, CWE, CPE, reference, or exploit data were provided. As a result, the affected package or component, the affected Ubuntu release or version range, and the conditions that trigger the flaw are all unidentified, and no statement can be made about whether exploitation requires authentication, user interaction, or a non-default configuration. No public exploit code or PoC reference was supplied with this record and no CISA KEV entry is indicated, so there is no public exploit identified at time of analysis. Risk cannot be meaningfully quantified from the supplied data, and assessment should be deferred until the Ubuntu CVE tracker entry for CVE-2026-115683 is retrieved.
Risk for CVE-2026-116266 cannot be meaningfully quantified from the supplied data: the record has no description, no CVSS base score or vector, no CWE, no EPSS estimate and no CISA KEV listing, and the only intelligence is a vendor-sourced report attributed to Ubuntu carrying a 'this_month' priority label. Because neither the affected Ubuntu package nor the vulnerable feature or interface is identified, the impact on confidentiality, integrity or availability, the attacker's prerequisites and the configurations at risk are all unverified, and authentication requirements are not confirmed from available data. No public exploit code has been identified at time of analysis, and no vendor-released patch is identified in the supplied data.