CVE-2026-87739
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submi
CVSS
—
No CVSS
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Sep 24, 2026 · Last modified: Sep 24, 2026 · CWE-639
Not enough EPSS history yet.
An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-967627.3 HIG—
———A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument client_id/segment_id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.9hCVE-2026-847206.5 MED—
———A flaw was found in the Ansible Automation Platform automation-controller. The
WorkflowJobNode.ancestor_artifacts database column, which stores the raw merged set_stats
artifacts propagated between workflow nodes, is not wrapped in prevent_search() and is therefore
accepted for arbitrary field lookups by the REST filter backend, even though it is omitted from
the API serializer. Because the column is persisted before Ansible's no_log masking is applied,
a user with only read access to a workflow — or, via a regular-expression lookup that bypasses
the JSON cross-relation filter guard through the world-readable credential-types endpoint, any
authenticated user with no roles — can use the result count as a boolean/count oracle to recover,
character by character, secret values that a playbook author explicitly marked no_log, including
across organizations.2hCVE-2026-847136.5 MED—
———A flaw was found in the automation-controller notification
subsystem. Although NotificationTemplate.notification_
configuration is protected from API filtering, its recipient
value is copied in clear text into the unprotected
Notification.recipients field on every send. Because the
credential-types endpoint is listable by any authenticated
user and the API filter backend traverses object relations
without per-hop authorization, a user with no privileges can
use a relational filter as a boolean count-oracle to recover,
character by character and across organizations, the secret
recipient values of other tenants' notifications — including
PagerDuty service keys and Slack/Mattermost/RocketChat/Webhook
bearer-token URLs. This flaw affects confidentiality.2hCVE-2026-956026.5 MED—
——0Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects YITH WooCommerce Request A Quote: from n/a before 4.46.1.14hCVE-2026-955925.3 MED—
——0Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions.13hCVE-2026-936235.3 MED—
——0Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.14h