CVE-2026-84831 Mandatory MFA bypass before enrollment

SEPPmail Secure Email Gateway before 15.0.7 creates a fully privileged session before required multi-factor authentication enrollment is completed. An attacker with the password for an MFA-required but unenrolled account can access protected functionality without providing a second factor...

EUVD-2026-70230

Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. Thi...

CVE-2026-73748

HPE Networking Fabric Composer is affected by an authenticated sensitive information disclosure vulnerability in its interface, where sensitive data is exposed in cleartext format . An attacker with administrative privileges can retrieve this information, which could be leveraged to gain further ...

CVE-2026-56143 Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a specially crafted request that causes excessive memory consumption, which may render the affected node...

Elasticsearch 8.19.20, 9.3.0 Security Update (ESA-2026-47)

Allocation of Resources Without Limits or Throttling in Elasticsearch Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to a denial of service via Excessive Allocation CAPEC-130. A user with elevated privileges can submit a special...

PT-2026-84469

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user with low-privileged access can execute arbitrary commands on the underlying operating system by submitting crafted input through the...

CVE-2023-20511

Release of an invalid pointer in the AMD kernel mode driver KMD could allow a privileged attacker to create a double free condition potentially leading to arbitrary code execution...

CVE-2026-78079 Joomla Extension - joomshaper.com - Privileged File Upload Bypass via Content Spoofing in Helix Ultimate < 2.2.10

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

EUVD-2026-66360

A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi Network Application to execute a Command Injection on an adopted device...

CVE-2026-78071

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78070

CVE-2026-78070 affects the DP Calendar Joomla extension (by digital-peak.com), versions 5.5.0 through 10.11.2 . The vulnerability is an authenticated blind SQL injection in the extension's content plugin , triggered when saving an article . Exploitation requires the attacker to hold update permis...

EUVD-2026-67650

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

EUVD-2026-67343

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

EUVD-2026-67350

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78495

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78499

A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78495 Dimension Server-Side Request Forgery via Remote Backup Connection Test

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78498 Dimension Server-Side Request Forgery via Email Server Test Settings

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78495 Dimension Server-Side Request Forgery via Remote Backup Connection Test

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...