CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-84282 A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin (version 9.12)

A Server-Side Request Forgery SSRF vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated...

CVE-2026-61516

The Netis NX10 (firmware V4.0.1.5808 and V3.0.0.4142) contains an information disclosure vulnerability in the sysinfo diagnostic endpoint of its web management interface. An unauthenticated attacker can retrieve the administrator password by sending a request to this action without a valid sessio...

CVE-2026-61516 Netis NX10 Credential Disclosure via sysinfo Diagnostic Endpoint

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

EUVD-2026-72805

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to retrieve the administrator password by sending a request to the sysinfo action in the web management interface without a valid session. Attackers can replay the...

EUVD-2026-72792

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin...

CVE-2026-18851

CVE-2026-18851 is a missing authorization vulnerability in Ivanti Endpoint Manager Mobile affecting versions before 12.10.0.0 , 12.9.0.2 , and 12.8.0.4 . The flaw allows a remote authenticated attacker to escalate privileges to admin , resulting in high impact on confidentiality, integrity, and a...

CVE-2026-18851

Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin...

Security Advisory - Ivanti Endpoint Manager Mobile (CVE-2026-18851)

Summary Ivanti has released updates for Ivanti Endpoint Manager Mobile EPMM which addresses one high severity vulnerability. Successful exploitation could lead to privilege escalation. We are not aware of any customers being exploited by this vulnerability at the time of disclosure. Vulnerability...

EUVD-2026-72790

A Cross-Site Request Forgery CSRF vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to trigger unauthorized snapshot creation by tricking an authenticated administrator into visiting a specially crafted web page...

CVE-2026-73317

XenForo before 2.3.13 contains a missing authorization flaw in the ACP cache-rebuild dispatcher . An administrator holding only the rebuildCache permission can supply an arbitrary job class and actor user ID in the POST body to invoke the approval queue job under any user identity, thereby approv...

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Overview While conducting research into a recent N-able N-central authentication bypass vulnerability CVE-2026-18577, Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker ...

CVE-2026-85400

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...

SmarterTools SmarterMail - Admin Password Reset

Detected a SmartMail admin password reset vulnerability by sending a POST request to the /api/v1/auth/force-reset-password endpoint, indicating that administrative password resets could potentially be triggered without proper authorization. id: CVE-2026-23760 info: name: SmarterTools SmarterMail ...

AC Smart II - Authentication Bypass

AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization. id: CVE-2025-10204 info: name: AC Smart II -...

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

Exploit for CVE-2026-8732

CVE-2026-8732 — WP Maps Pro Unauthenticated Admin Creation E...

PT-2026-87128

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.11 Description An authenticated control panel user with the administrateUsers permission can activate a pending or deactivated administrator account. This occurs because the...

PT-2026-88464

U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to Cleartext transmission of administration credentials over HTTP...

CVE-2026-79588

The U-speed WIFI4 N300 T1 Pro v1.0.0 is vulnerable to the cleartext transmission of administration credentials over HTTP . This flaw allows for the potential interception of sensitive login information. Exploitation details and specific remediation steps are not provided in the available documents.