Section

Vulnerabilities

CVE records from NVD, ZDI advisories and the CISA KEV catalog, with CVSS, EPSS, SSVC and exploitation state.

6 matching records.

1. 38
   CVE NVD 1h ago

   Group-Office is an enterprise customer relationship management and groupware tool.

   Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.167, 25.0.102, and 26.0.27, the Contact/labels JMAP endpoint in GroupOffice accepts a fully attacker-controlled template…

   CVSS 9.4 Fix available CVE-2026-63011 Intermesh
2. 30
   CVE NVD 1h ago

   Group-Office is an enterprise customer relationship management and groupware tool.

   Group-Office is an enterprise customer relationship management and groupware tool. Prior to versions 6.8.172, 25.0.108, and 26.0.33, a low-privileged user can create manual reminders containing arbitrary HTML/JavaScript and…

   CVSS 8.7 Fix available CVE-2026-63010 Intermesh
3. 23
   CVE NVD 1h ago

   Group-Office is an enterprise customer relationship management and groupware tool.

   Group-Office is an enterprise customer relationship management and groupware tool. Prior to version 26.0.37, go/modules/community/bookmarks/controller/Bookmark.php's description() action takes a fully attacker-controlled url…

   CVSS 5.0 Fix available CVE-2026-63653 Intermesh
4. 18
   CVE NVD 18h ago

   Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue…

   Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths…

   CVSS 6.5 CVE-2026-125390 Intermesh
5. 18
   CVE NVD 18h ago

   Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed…

   Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing…

   CVSS 6.1 CVE-2026-125389 Intermesh
6. 18
   CVE NVD 18h ago

   Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to…

   Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can…

   CVSS 6.5 CVE-2026-125388 Intermesh

Same filters as JSON: /api/items?category=vuln&window=30d&vendor=Intermesh&limit=100. RSS for this section: feed.xml.