Critical vulnerability intelligence.

146

CVE-2026-81468

Dell ThinOS 10 versions before 2605_10. 2616 contain a command injection flaw that lets a high‑privileged attacker with remote access run arbitrary commands on the device. This could lead to full system compromise.

Critical· 9.12% likely

147

CVE-2026-81467

Dell ThinOS 10 versions before 2605_10.2616 contain a command injection flaw that lets an unauthenticated attacker run arbitrary commands on the device. This could give the attacker full control over the system. The vulnerability is rated critical with a CVSS score of 9.8.

Critical· 9.84% likely

Critical· 9.61% likelyfix available

148

CVE-2026-81048

Dell ThinOS 10 versions before 2605_10.2616 allow attackers on the same network to run arbitrary commands, giving them full control of the device.

149

CVE-2026-81046

Dell ThinOS 10 versions before 2605_10.2616 contain a protection‑mechanism failure that could let an unauthenticated attacker run arbitrary code on the device. The flaw is exploitable remotely without authentication or user interaction. It is rated critical with a CVSS score of 9.4.

Critical· 9.4<1% likely

Critical· 9.1<1% likelyfix available

150

CVE-2026-88007

Traefik, an open‑source HTTP reverse proxy, had a flaw that let attackers reuse authenticated connections when HTTP/3 was enabled. The bug allowed an attacker to read data meant for another user and impersonate that user without knowing their credentials. The issue is fixed in newer releases.

151

CVE-2026-81800

This vulnerability is an unauthenticated SQL injection in the Avis Vérifiés Verified Reviews plugin, affecting versions up to 2.4.6. It allows attackers to read or modify database data without authentication.

152

CVE-2026-88887

Renovate, a tool that automatically updates dependencies, can leak registry credentials when it follows pagination links from a container registry. The tool attaches its credentials to any follow‑up request without checking that the link points to the same registry, allowing a malicious registry to steal those credentials. This flaw is fixed in newer releases of Renovate and Mend Renovate.

153

CVE-2026-88882

Renovate, a tool that automates dependency updates, had a flaw that let it send registry credentials to attacker‑controlled servers when following pagination links from a NuGet registry. The issue existed in versions before 44.11.2 and is fixed in newer releases by restricting pagination to the same origin.

154

CVE-2026-88881

Renovate, a tool that automatically updates dependencies, can send stored credentials to an attacker-controlled host if the GitHub server it talks to returns a malicious pagination link. The flaw allows an attacker who controls or compromises the GitHub server to steal credentials. The issue is fixed in Renovate 44.11.3 and related Mend images and helm charts.

155

CVE-2026-88880

Renovate versions older than 44.11.3 do not check the Link header when following GitLab pagination. This allows a malicious GitLab server to redirect requests that contain credentials to an attacker-controlled site, leaking authentication data. The flaw is exploitable without any user interaction.

Critical· 9.3<1% likelyfix available

156

CVE-2026-88877

Traefik, a popular HTTP reverse proxy and load balancer, has a critical flaw in versions 3.7.0 through 3.7.11. When an Ingress uses both an authentication annotation and the from‑to‑www‑redirect annotation, Traefik creates a hidden router that bypasses authentication and other middle‑ware. Updating to version 3.7.12 or later removes the vulnerability.

157

CVE-2026-88869

A stored cross‑site scripting (XSS) flaw exists in the AD_Server plugin’s log.php endpoint. An unauthenticated attacker can inject malicious HTML via the label parameter, which is later rendered unsanitized in the admin Ad Types report. This allows arbitrary JavaScript to run in an administrator’s browser session.

158

CVE-2026-88868

A stored cross‑site scripting (XSS) flaw exists in the LiveLinks plugin for AVideo. The plugin saves title and description fields without sanitizing them, allowing a user with canStream permission to inject malicious scripts that run in the browsers of all visitors, including site administrators. This can lead to session hijacking, defacement, or data theft.

159

CVE-2026-88867

WWBN AVideo, up to a specific commit, has a stored cross‑site scripting flaw that lets logged‑in users inject JavaScript into category names. The script runs in the browsers of anyone who views a video or gallery entry that uses the malicious category, including administrators.

160

CVE-2026-88866

WWBN AVideo’s LoginControl plugin stores the User‑Agent header in login history without encoding it, letting anyone with a valid account inject JavaScript that runs when an administrator views the history page.

161

CVE-2026-88864

Capgo (capgo.app) does not properly restrict write access to the public.sso_providers table exposed through Supabase PostgREST. An attacker who possesses an ordinary Capgo full API key can insert a forged row with status='active' and enforce_sso=true, bypassing all intended SSO provisioning controls. This allows the attacker to assert SSO enforcement for any domain, disrupting normal login. All versions are affected and, at the time of the advisory, no patch was available.

162

CVE-2026-88860

Capgo, a platform for over-the-air updates, has a flaw that lets users keep channel permissions even after their main organization role is removed. This can let attackers perform actions they should no longer be able to, such as changing production firmware. The issue is critical because it bypasses normal access controls.