CVE-2021-31159

Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration CVE-2021-31159 This script takes advantage of ServiceDesk Plus before build 10519 having different output in the password recovery functionality: if the user exists it returns a message claiming an email has been sent but ...

CVE-2026-112892

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an...

CVE-2026-112892

The Pillow Python imaging library (versions 4.1.0 to 13.0.0 ) contains a vulnerability in the MSP RLE decoder where a small file can expand into an unbounded in-memory buffer . The root cause is that the decoder writes run-length output to BytesIO without limiting expansion to the declared image ...

CVE-2026-112892

Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacker can supply a crafted MSP image to an...

EUVD-2026-101709

In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive responses that distinguish nonexistent users, invalid...

CVE-2026-107795

The TP-Link Omada Controller contains an improper authorization vulnerability in its MSP and OpenAPI certificate/private-key management APIs . Due to a failure to properly enforce administrative authorization, an authenticated user can perform privileged certificate management operations. Success...

PT-2026-113998

Name of the Vulnerable Software and Affected Versions Omada Controller affected versions not specified Description Improper administrative authorization in the MSP and OpenAPI certificate and private-key management APIs allows an authenticated user to perform privileged operations. A low-privileg...

PT-2026-113935

Name of the Vulnerable Software and Affected Versions Omada Controller affected versions not specified Description In MSP mode, the user-confirmation endpoint fails to enforce necessary permission checks. An authenticated user can provide a caller-controlled Identifier parameter to validate...

CVE-2026-19599

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module...

EUVD-2026-85272

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module...

CVE-2026-19599 Remote Code Execution vulnerability

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module...

CVE-2026-19599

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below are vulnerable to a Remote Code Execution (RCE) vulnerability located in the Notification Profile module . The root cause is identified as the Improper Neutralization of Special Elements used in an OS Command . This vulnerability cou...

CVE-2026-19599 Remote Code Execution vulnerability

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module...

CVE-2026-19599: Improper Neutralization of Special Elements used in an OS Command

ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module...

PT-2026-97305

Name of the Vulnerable Software and Affected Versions ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and earlier Description A Remote Code Execution issue exists within the Notification Profile module, which could allow an attacker to execute arbitrary code on the server. Recommendations...

PT-2026-80989

Name of the Vulnerable Software and Affected Versions D-Link DI-7001 MINI 5G version 19.10.31A1 Description A code execution issue exists in the msp info endpoint. An attacker can exploit the flag parameter to execute arbitrary commands on the system. Recommendations At the moment, there is no...

PT-2026-80994

Name of the Vulnerable Software and Affected Versions D-Link DI-8100G version 17.12.20A1 Description An issue exists in the msp info endpoint where the flag parameter can be exploited to execute arbitrary code. Arbitrary code execution allows an attacker to run unauthorized commands on the system...

CVE-2026-55730 Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

EUVD-2026-48595

Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...

CVE-2026-8940

The WP Meta Sort Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the top-level included script in msp-options.php. This makes it possible for unauthenticated attackers to chan...