PaperCut NG/MF Critical Zero-Day Exploited in the Wild

Overview On August 27, 2026, PaperCut Software published an urgent security advisory stating that it is investigating active exploitation of a vulnerability affecting PaperCut NG and PaperCut MF. PaperCut has confirmed customer incidents and is treating the issue as a security emergency. At the...

CVE-2026-78071 Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78071

DP Calendar is a Joomla extension by digital-peak.com. Versions 7.0.0 through 10.11.2 are affected by an authenticated, privileged stored XSS . The root cause is that the location title is rendered in a data attribute without proper escaping. Exploitation requires an authenticated user with the c...

EUVD-2026-67653

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78070

CVE-2026-78070 affects the DP Calendar Joomla extension (by digital-peak.com), versions 5.5.0 through 10.11.2 . The vulnerability is an authenticated blind SQL injection in the extension's content plugin , triggered when saving an article . Exploitation requires the attacker to hold update permis...

EUVD-2026-67650

Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 - Saving an article can trigger a blind SQL injection with content plugin, needs update permission for articles...

EUVD-2026-67350

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

EUVD-2026-67348

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

EUVD-2026-67343

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

EUVD-2026-67356

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78495

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78498

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78499

A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78500: Observable Timing Discrepancy

A blind server-side request forgery SSRF vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

PT-2026-83077

Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0 - 10.11.2 - Location title is rendered in data attribute without escaping leads to XSS, needs create permission in DPCalendar...

CVE-2026-78495: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78499: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability WatchGuard Dimension FTP Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78498: Server-Side Request Forgery (SSRF)

A server-side request forgery SSRF vulnerability WatchGuard Dimension Email Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...

CVE-2026-78174: Exposure of Sensitive Information to an Unauthorized Actor

WatchGuard Dimension records unredacted session identifiers for logged-in users in its web UI diagnostic log. A low-privileged Dimension Administrator can retrieve this log and extract a Super Administrator's session token while that administrator is logged in, enabling account takeover...

CVE-2026-78495 Dimension Server-Side Request Forgery via Remote Backup Connection Test

A server-side request forgery SSRF vulnerability WatchGuard Dimension Remote Backup Connection Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems...