CVE-2026-86819

Waves Central for macOS contains a local privilege escalation in its privileged helper service. The root cause is improper XPC client authentication : the helper validates connecting clients by comparing the caller's code-signing certificate chain for equality with its own, rather than checking a...

Waves Central local privilege escalation via Improper XPC Client Authentication in macOS

RISK EVALUATION Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code...

CVE-2026-86206, CVE-2026-86207: N-able N-central Authentication Bypass (FIXED)

Overview While conducting research into a recent N-able N-central authentication bypass vulnerability CVE-2026-18577, Rapid7 Labs discovered two new vulnerabilities affecting the latest version of N-central. When chained together, these two vulnerabilities allow a remote unauthenticated attacker ...

N-central - Authentication Bypass

N-central 3 matchers-condition: and matchers: - type: word words: - "SessionID" - "sessionHelloResponse" condition: and - type: status...

N-central - XML External Entities Injection

N-central versions %xxe; rand http: - raw: - | POST /dms/services/ServerUI HTTP/2 Host: Hostname Content-Type: text/xml Soapaction: "" soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope...

N-able N-central Static Code Injection Vulnerability

N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution...

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Turning off email images should at least stop the pictures. This week, attackers had a workaround: a scannable QR code built out of text. It still appears, even with images blocked. A small detail, but an annoying one if that was a precaution you were counting on. Elsewhere, a trusted software...

CVE-2026-85640

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component...

CVE-2026-77699

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77697

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

CVE-2026-77697

ManageEngine Endpoint Central (by Zohocorp) versions below 11.4.2540.23 are affected by a Privilege Escalation vulnerability during JAR extraction. The flaw allows a locally authenticated user with low privileges to escalate their permissions, with changed scope impacting the confidentiality, int...

EUVD-2026-72340

Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction...

CVE-2026-85640

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are affected by a Privilege Escalation Due to Outdated Component vulnerability. The CVSS 3.1 score is 6.3 (MEDIUM) with a local attack vector, low complexity, and low privileges required, resulting in low impact on confidentiality...

EUVD-2026-72338

Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component...

CVE-2026-77699

ManageEngine Endpoint Central (Zohocorp) versions below 11.5.2605.01 are susceptible to a local privilege escalation caused by loading a DLL from an untrusted path . An attacker with low-level local access and the ability to prompt a user for interaction could exploit this to gain elevated privil...

CVE-2026-77699 Privilege Escalation

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

EUVD-2026-72337

Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path...

CVE-2026-77698

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...

EUVD-2026-72325

Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade...

CVE-2026-77698

ManageEngine Endpoint Central by Zohocorp, in versions prior to 11.5.2605.01 , is affected by a local privilege escalation vulnerability triggered through the Agent upgrade process. An attacker with low local privileges and user interaction can escalate their access, resulting in low impact to co...