CVE-2026-22283

HighCVSS 7.5/10Last modified Jun 25, 2026

Description

Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-829

Affected software

No affected versions have been published.

Timeline

Published: Jun 17, 2026
Last modified: Jun 25, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-222847.2Dell SmartFabric OS10 Software, versions prior to 10.5.6.12, contains an Improper Neutralization of Special Elements used in a Command ('Com CVE-2026-222854.4Dell Device Management Agent (DDMA), versions prior to 26.02, contain a Plaintext Storage of Password vulnerability. A high privileged attac CVE-2026-22297.5ImpactThe undici WebSocket client is vulnerable to a denial-of-service attack due to improper validation of the server_max_window_bits param CVE-2026-22304.3The Booking Calendar plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 10.14.14 v CVE-2026-2230610.0Download of code without integrity check, inclusion of functionality from untrusted control sphere, and cleartext transmission of sensitive CVE-2026-22317.2The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and incl CVE-2026-223128.6The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker t CVE-2026-223139.1The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injecti CVE-2026-223166.5A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based B CVE-2026-223177.2A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HT CVE-2026-223184.9A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send overs CVE-2026-223194.9A stack-based buffer overflow in the device's file installation workflow allows a high-privileged attacker to send oversized POST parameters