CVE-2026-86375

MediumCVSS 6.2/10Last modified Oct 19, 2026

Description

Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-311

Affected software

No affected versions have been published.

Timeline

Published: Oct 19, 2026
Last modified: Oct 19, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-864048.8EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoa CVE-2026-864059.8Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Mo CVE-2026-864067.5The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, an CVE-2026-864073.7The User Registration & Membership WordPress plugin before 5.2.8 does not verify that the visitor requesting its membership confirmation pa CVE-2026-864086.5Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view()CVE-2026-86409Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent tran CVE-2026-86410A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, an CVE-2026-86411An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy handle upgraded with `CVE-2026-86412A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using CVE-2026-86413When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl could pass on its creden CVE-2026-86414An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket) to the proxy itself, CVE-2026-86415libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schann