CVE-2026-76113

MediumCVSS 4.3/10Last modified Oct 18, 2026

Description

Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the redfish_certificate resource component. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-532

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Dell	Terraform Provider for Redfish	< 1.6.2 or later

References

https://www.dell.com/support/kbdoc/en-in/000515444/dsa-2026-434-security-update-for-dell-terraform-provider-for-dell-server-multiple-vulnerabilities?msockid=3021cac2195069ed3194ddad186a68f9

Timeline

Published: Oct 14, 2026
Last modified: Oct 18, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-761145.9Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information v CVE-2026-76124.7A vulnerability was determined in itsourcecode Courier Management System 1.0. Affected is an unknown function of the file /edit_user.php. Ex CVE-2026-761248.8The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedb CVE-2026-761286.4The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versi CVE-2026-76137.2The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value CVE-2026-761315.3Use of hard-coded credentials issue exists in VOCALOID6 , which may allow an attacker to impersonate a legitimate VOCALOID6 Editor and gain CVE-2026-761339.8The affected Ebyte product uses a deprecated hashing algorithm in an authentication-related operation. Under conditions where an attacke CVE-2026-761373.3Missing authentication for critical function vulnerability exists in VOCALOID6. Any process running under the same local user account as a r CVE-2026-761398.0A flaw was found in acm-operator-bundle. The build process for this component downloads and runs a script from a remote source without verif CVE-2026-76144.3The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This CVE-2026-761429.3Insufficient authentication and access control on the internal-only IPC SOAP endpoint of the Genian NAC/ZTNA policy server allows an unauthe CVE-2026-761437.3A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login req