CVE-2026-14571

The NoviGest Desktop App's Java RMI service lacks authentication in critical functions. An attacker with network access can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained to execute operating system commands on the server.

Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems.

Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems.

Dell PowerProtect Data Domain contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could exploit it to achieve command execution.

Dell PowerProtect Data Domain contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to credential exposure.

Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could exploit it to elevate privileges, potentially impacting other managed Data Domain systems.

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to execute arbitrary commands with root privileges, allowing complete system takeover.

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to create a privileged account, leading to complete system takeover.

The Contact Manager plugin for WordPress in versions up to and including 9.1.2 is vulnerable to arbitrary file upload via the add_message function. An incomplete extension blacklist allows bypassing validation with a trailing dot, enabling unauthenticated attackers to upload executable files and potentially achieve remote code execution.

Improper Control of Generation of Code in the Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection.