Lỗ hổng mới
Lỗ hổng nghiêm trọng mới công bố (CVSS ≥ ngưỡng) hoặc đang bị khai thác thực tế (CISA KEV), gom từ NVD, GitHub Advisory, CVE.org, OSV và CISA KEV.
| ID | Tóm tắt | CVSS | Sản phẩm / package | Công bố | Nguồn |
|---|---|---|---|---|---|
| CVE-2026-115607 Lộ dữ liệu | WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability | 9.3 CRITICAL | Crowd Favorite DXP ToolKit | NVD, CVE.org | |
| CVE-2026-67073 RCE Truy cập trái phép Lộ dữ liệu | HCL BigFix AEX is affected by multiple security vulnerabilities. | 8.6 HIGH | HCL Software BigFix AEX | NVD, CVE.org | |
| CVE-2026-118485 Lộ dữ liệu | Axel Download Accelerator Path Traversal via URL Filename Decoding | 8.1 HIGH | Axel Download Accelerator Axel | NVD, CVE.org | |
| CVE-2026-103792 Lộ dữ liệu | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40... | 9.6 CRITICAL | Dell PowerProtect Data Domain Management Center | NVD, CVE.org | |
| CVE-2026-103779 Truy cập trái phép | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 8.3 HIGH | Dell PowerProtect Data Domain | NVD, CVE.org | |
| CVE-2026-112198 Lộ dữ liệu | Improper Restriction of XML External Entity Reference in Tactis' NoviGest Desktop App | 8.3 HIGH | Tactis NoviGest Desktop App | NVD, CVE.org | |
| CVE-2026-103799 Truy cập trái phép | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40... | 9.6 CRITICAL | Dell PowerProtect Data Domain Management Center | NVD, CVE.org | |
| CVE-2026-112197 Truy cập trái phép | Missing Authentication for Critical Function in Tactis' NoviGest Desktop App | 9.4 CRITICAL | Tactis NoviGest Desktop App | NVD, CVE.org | |
| CVE-2026-14571 Lộ dữ liệu | SQL injection (SQLi) in the user authentication module of Futurum Software | 9.1 CRITICAL | Futurum Software Futurum Software User Authentication Module | NVD, CVE.org | |
| CVE-2026-86397 Truy cập trái phép | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 9.8 CRITICAL | Dell PowerProtect Data Domain | NVD, CVE.org | |
| CVE-2026-86398 Lộ dữ liệu | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 8.8 HIGH | Dell PowerProtect Data Domain | NVD, CVE.org | |
| CVE-2026-86400 RCE Truy cập trái phép | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release ... | 9.8 CRITICAL | Dell PowerProtect Data Domain | NVD, CVE.org | |
| CVE-2026-90717 Truy cập trái phép | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40... | 9.1 CRITICAL | Dell PowerProtect Data Domain Management Center | NVD, CVE.org | |
| CVE-2026-92797 Truy cập trái phép | Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter | 8.8 HIGH | MemberPress Memberpress | NVD, CVE.org | |
| CVE-2026-111357 KEV Truy cập trái phép | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | — | Ivanti Connect Secure | CISA KEV |