CVE-2026-34838 Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.156, 25.0.90, and 26.0.12, a vulnerability in the AbstractSettingsCollection model leads to insecure deserialization when these settings are loaded. By injecting a serialized FileCookieJar...

EUVD-2026-18424

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image Windows before build 42902...

CVE-2026-33271

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image Windows before build 42902...

CVE-2026-33271

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image Windows before build 42902...

CVE-2026-33271

CVE-2026-33271 is an observed local privilege escalation in Acronis True Image (Windows) before build 42902, caused by insecure folder permissions. The issue enables elevation of privileges from a local attacker. CVSSv3 metrics indicate a Local attack vector, High impact on Confidentiality, Integ...

CVE-2026-29782 OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint $skippermissions = true. It loads a record from the zzoauth2 table using the attacker-controlled GET parameter...

CVE-2026-29782 OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint $skippermissions = true. It loads a record from the zzoauth2 table using the attacker-controlled GET parameter...

CVE-2026-29782 OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

OpenSTAManager is an open source management software for technical assistance and invoicing. Prior to version 2.10.2, the oauth2.php file in OpenSTAManager is an unauthenticated endpoint $skippermissions = true. It loads a record from the zzoauth2 table using the attacker-controlled GET parameter...

CVE-2026-29782

OpenSTAManager CVE-2026-29782 describes an unauthenticated deserialization vulnerability in the OAuth2 flow. The oauth2.php endpoint reads and deserializes the access_token field from zz_oauth2 without class restrictions, enabling an attacker who can modify the database (e.g., via another vulnera...

CVE-2026-4947

Addressed a potential insecure direct object reference IDOR vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-supplied object identifiers, potentially...

EUVD-2026-18095

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions...

CVE-2026-21765

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions...

HCL BigFix Platform 安全漏洞

The HCL BigFix Platform is a developed by the Indian company HCL. This platform supports automatic discovery, management, and remediation of endpoint security issues. There are security vulnerabilities in the HCL BigFix Platform, which stem from insecure private encryption key permissions. This m...

PT-2026-29845

Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis True Image Windows before build 42902...

Acronis True Image 安全漏洞

Acronis True Image is a renowned data backup and restoration software developed by the Swiss company Acronis. This software can be used to create drive and disk images, and restore them when a clean system is required. Versions of Acronis True Image prior to build 42902 contained security...

PT-2026-29881

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.156, 25.0.90, and 26.0.12 Description Group-Office, an enterprise customer relationship management and groupware tool, is affected by an insecure deserialization issue in the AbstractSettingsCollection model...

Group Office 代码问题漏洞

Group Office is a modular office suite developed by the Dutch company Group Office. Versions of Group Office prior to 6.8.156, 25.0.90, and 26.0.12 contained code vulnerabilities. These vulnerabilities stemmed from insecure deserialization in the AbstractSettingsCollection model, which could allo...

CVE-2026-21765

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions...

CVE-2026-21765 HCL BigFix Platform is affected by insecure permissions on private cryptographic keys

HCL BigFix Platform is affected by insecure permissions on private cryptographic keys. The private cryptographic keys located on a Windows host machine might be subject to overly permissive file system permissions...

CVE-2026-21765

CVE-2026-21765 concerns the HCL BigFix Platform, where private cryptographic keys on Windows hosts may have overly permissive file system permissions. The root cause stated is insecure permissions on private keys, potentially exposing confidentiality, integrity, and availability (all scored high)...