CVE WatchSep 1, 2026

CVE-2026-84115

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the co

CVSS

8.3

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 1, 2026 · Last modified: Sep 1, 2026 · CWE-266 · CWE-269

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-84358—

—

———Improper privilege management in Downloads in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)2h CVE-2026-737472.5 LOW

—

———A local privilege-escalation vulnerability has been discovered in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user with local access to elevate their user privileges and make limited modifications on the affected system.5h CVE-2026-737404.4 MED

—

———A local privilege escalation vulnerability in HPE Networking Fabric Composer could allow an authenticated privileged user on the underlying host to elevate their user privileges to those of a higher role. A successful exploit allows the attacker to change the state of certain settings of the affected system.5h CVE-2026-185509.8 CRI

—

———The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.6.6. This is due to insufficient reset token validation in the `nokri_reset_password()` function, which allows empty attacker-supplied reset tokens to match empty or unset `sb_password_forget_token` user meta values. This makes it possible for unauthenticated attackers to reset the password of any user, including administrators, and gain access to their account.6h CVE-2026-812977.5 HIG

—

———Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions.6h CVE-2026-828355.4 MED

—

———A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument file_id can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.11h