CVE-2026-90444

The NoviGest Desktop App's Java RMI service lacks authentication in critical functions. An attacker with network access can invoke remote methods without authentication, obtain sensitive credentials, and execute arbitrary SQL queries on PostgreSQL. The elevated privileges of the database account allow these capabilities to be chained to execute operating system commands on the server.

Dell PowerProtect Data Domain Management Center contains a Missing Authorization vulnerability. A low-privileged attacker with remote access could exploit it to perform unauthorized system operations on managed systems.

Dell PowerProtect Data Domain Management Center contains an SQL Injection vulnerability. A low-privileged attacker with remote access could exploit it to gain unauthorized access to managed systems.

Dell PowerProtect Data Domain contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with remote access could exploit it to achieve command execution.

Dell PowerProtect Data Domain contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to credential exposure.

A Blind SQL Injection vulnerability in Futurum Software's management software is caused by inadequate validation and sanitisation of user-provided inputs in queries to the private area's database, as well as an incorrect WAF configuration. This weakness allows protection mechanisms to be bypassed by sending manipulated HTTP requests.

Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could exploit it to elevate privileges, potentially impacting other managed Data Domain systems.

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to execute arbitrary commands with root privileges, allowing complete system takeover.

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to create a privileged account, leading to complete system takeover.

The Contact Manager plugin for WordPress in versions up to and including 9.1.2 is vulnerable to arbitrary file upload via the add_message function. An incomplete extension blacklist allows bypassing validation with a trailing dot, enabling unauthenticated attackers to upload executable files and potentially achieve remote code execution.