CVE-2026-82155

HIGH7.8

Published 2026-11-03 · Source security_alert@emc.com

Description

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Untrusted Search Path vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Command execution.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-428

References

https://www.dell.com/support/kbdoc/en-us/000515018/dsa-2026-445-security-update-for-dell-os-recovery-tool-for-multiple-vulnerabilities

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-121731
RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL via the unquoted period_id parameter in StudentSummary.php. Attackers can supply payloads without single quotes into IN() clauses to extract administrator password hashes and student records through time-based queries or modify data via stacked statements.
2026-11-03 · score 8.8
CVE-2026-121729
emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authenticated member to list, create and revoke API keys. Attackers can mint a global live API key accepted by /v1/send to send mail from any domain, or revoke existing keys to disable integrations.
2026-11-03 · score 8.3
CVE-2026-121727
Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass http_body_max by sending more body bytes than declared. Attackers can send oversized first segments over many concurrent POST, PUT or DELETE connections, wrapping content_length to grow buffers unbounded and exhaust worker memory.
2026-11-03 · score 7.5
CVE-2026-121565
Tanium addressed an improper certificate validation vulnerability in multiple products. Products have been updated to distrust several intermediate CA certificates associated with compromised private keys.
2026-11-03 · score 7.4
CVE-2026-120775
Tanium addressed a heap-based buffer overflow vulnerability in Deploy.
2026-11-03 · score 7.2