CVE-2019-10008

CVE-2019-10008 ManageEngine Service Desk Plus 9.3 Privilaged account Hijacking Date: 30-03-2019 Exploit Author: Ata Hakçıl, Melih Kaan Yıldız Vendor: ManageEngine Vendor Homepage:www.manageengine.com Product: Service Desk Plus Version: 10.0 Tested On: Windows 10 64 bit CVE : 2019-10008 Complete P...

CVE-2026-120015 Insufficient Input Validation in SAP Host Agent

SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successful exploitation could lead to persiste...

CVE-2026-112169

Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification...

CVE-2026-112169

Magistra software contains undocumented backdoor functionality that enables an authentication bypass . This flaw allows an attacker to create a privileged user account without requiring credential verification. Exploitation details and specific patch information are not provided in the documents....

EUVD-2026-120040

Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification...

PT-2026-140399

Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification...

PT-2026-140425

Name of the Vulnerable Software and Affected Versions HPE Morpheus Software versions prior to 9.0.2-3 HPE Morpheus Software versions prior to 9.1.0-2 Description A remote code execution issue allows a low-privileged account to execute code on the appliance managing VM connections without requirin...

CVE-2026-112169: GALENO SISTEMI MAGISTRA: Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a…

Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification...

CVE-2026-86397

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

CVE-2026-86397

Dell PowerProtect Data Domain is impacted by an Improper Authentication vulnerability (CWE-862) affecting Feature Release versions 7.7.1.0 through 8.8, LTS2024 versions 7.13.1.0 through 7.13.1.80, LTS2025 versions 8.3.1.0 through 8.3.1.40, and LTS2026 versions 8.6.1.0 through 8.6.1.20. An unauthe...

CVE-2026-86397

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

CVE-2026-86397

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

EUVD-2026-111841

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

CVE-2026-86397: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

PT-2026-127916

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. An...

CVE-2026-54641: Authorization Bypass Through User-Controlled Key

OpenRemote is an open-source internet-of-things platform. Prior to 1.24.2, the get, getUserClientRoles, and getUserRealmRoles methods in manager/src/main/java/org/openremote/manager/security/UserResourceImpl.java authorize callers with the read:admin role without confirming that the target UUID...

CVE-2026-109608 Frappe ERPNext before 15.121.0 SQL Injection via Unvalidated Endpoint Input

Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation. Any authenticated user, including one with no assigned roles, can send specially crafted requests to read other users' sensitive information and escalate...

PT-2026-111074

Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to read financial da...

PT-2026-97686

Attackers chained CVE-2024-67279 and CVE-2024-86060 to compromise MikroTik routers without authentication, creating privileged accounts and exfiltrating network configurations. Router compromise enables pivoting to internal segments that bypass perimeter defenses. ZeroTrust 🔗 Full TRC analysis:...

CVE-2026-84398

CareCam CM2507 IP cameras are vulnerable to unauthorized access due to an empty password accepted for a privileged account exposed through the ONVIF management service. The root cause is an empty password stored in a configuration file, allowing an attacker with network access to reach privileged...