CVE-2026-90774

Dell PowerProtect Data Domain contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with remote access could exploit this vulnerability, leading to credential exposure.

A Blind SQL Injection vulnerability in Futurum Software's management software is caused by inadequate validation and sanitisation of user-provided inputs in queries to the private area's database, as well as an incorrect WAF configuration. This weakness allows protection mechanisms to be bypassed by sending manipulated HTTP requests.

Dell PowerProtect Data Domain Management Center contains an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with remote access could exploit it to elevate privileges, potentially impacting other managed Data Domain systems.

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to execute arbitrary commands with root privileges, allowing complete system takeover.

Dell PowerProtect Data Domain contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could exploit it to create a privileged account, leading to complete system takeover.

The Contact Manager plugin for WordPress in versions up to and including 9.1.2 is vulnerable to arbitrary file upload via the add_message function. An incomplete extension blacklist allows bypassing validation with a trailing dot, enabling unauthenticated attackers to upload executable files and potentially achieve remote code execution.

Improper Control of Generation of Code in the Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection.

The Pie Register Premium plugin for WordPress up to and including 3.8.4.0 is vulnerable to unrestricted file type upload via the piereg_file_upload function. File type validation errors are not checked before move_uploaded_file(), and the AJAX handler lacks nonce and capability checks, allowing unauthenticated attackers to upload PHP files and achieve remote code execution.

The Jupiter X Core plugin for WordPress (up to and including 4.61.0) is vulnerable to authentication bypass in its Twitter/X social login handler. The verify_twitter_callback function fails to reassign the returned credentials to the TwitterOAuth client, so the subsequent API call remains signed with the site operator's stored token, and the plugin authenticates a WordPress account based solely on the X app owner's email address.

A vulnerability in jackson-databind allows bypassing generic-argument validation: only the outer class of a type ID is checked, while attacker-selected classes inside generic arguments are accepted. This enables deserialization of dangerous classes (e.g., HashMap<FileSystemXmlApplicationContext,String>) even with a validator enabled, potentially leading to remote code execution. Affects versions 2.10.0+ and 3.0.0+; it is an incomplete fix for CVE-2026-54512.