CVE-2026-87739

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. Because user permissions are not evaluated during this process, an attacker can submit report generation requests without valid credentials. This flaw allows for the...

EUVD-2026-85812

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

PT-2026-98195

Name of the Vulnerable Software and Affected Versions @rsdoctor/rspack-plugin versions prior to 1.5.16 Description The default report HTTP server started by @rsdoctor/rspack-plugin binds to all network interfaces 0.0.0.0 and serves a POST /api/data/key endpoint without authentication and with...

PT-2026-97724

Name of the Vulnerable Software and Affected Versions PaperCut MF/NG affected versions not specified Description An improper authentication issue allows an unauthenticated remote attacker to trigger report generation. By submitting requests without valid credentials, an attacker can generate...

CVE-2026-87739: Authorization Bypass Through User-Controlled Key

An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information...

CISA: CISA Election Report

From around 2019 to 2024, the Cybersecurity and Infrastructure Security Agency CISA conducted a set of technical and operational activities to evaluate the security of certain U.S. election systems. These activities, all carried out upon the request of system owners and operators, included direct...

CVE-2026-84787

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-84787 Privilege Escalation vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

EUVD-2026-85262

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-84787

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are vulnerable to a Privilege Escalation vulnerability. An authenticated low-privilege user can gain Administrator privileges by exploiting the Report Profile import functionality. The vulnerability carries a base s...

CVE-2026-84787 Privilege Escalation vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

EUVD-2026-85260

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-84791

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below are affected by a Broken Access Control vulnerability. This flaw allows an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls that are outside of their assigned...

CVE-2026-84791 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-84791 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

PT-2026-97297

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An issue exists where an authenticated low-privilege user can modify Change Management report schedule configurations for...

PT-2026-97304

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.711 ManageEngine Firewall Analyzer versions prior to 12.8.711 Description An authenticated low-privilege user can gain Administrator privileges through the Report Profile import feature. This issue...

CVE-2026-84787: Execution with Unnecessary Privileges

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import...

CVE-2026-95683

In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using only the event ID as the lookup condition, without applying the report's own distribution/ACL constraints. Because MISP reports carry an...

CVE-2026-95685 MISP Missing Authorization on replaceSuggestionInReport Event Report Action

MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content within an event report, was incorrectly mapped to the wildcard permission '' in the ACLComponent, making it accessible to any authenticated...