CVE-2026-82078

UNKNOWN

Published 2026-08-28 · Updated 2026-08-29 · Source eb41dac7-0af8-4f84-9f6d-0272772514f4

Description

An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an attacker can manipulate system configuration parameters, this enables the execution of arbitrary Java bytecode residing on the application classpath under the security context of the PaperCut server process.

CWE-470

References

https://www.papercut.com/kb/Main/security-bulletin-27-aug-2026-urgent-security-advisory/

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-19410
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and no customer action is needed.
2026-08-31 · score —
CVE-2026-82838
The default docker image shipped for Venueless did not properly ensure that uploaded SVG files could not be delivered with executable JavaScript content. A valid Content Security Policy is now set.
2026-08-31 · score —
CVE-2026-58301
When Apache Shiro is used with the Jakarta EE integration module, a low-privileged user can craft an HTTP request that causes the server to initiate a connection to an attacker-controlled URL and transmit attacker-controlled data. This vulnerability affects Apache Shiro versions 2.x through 3.0.0 only in deployments that use the Jakarta EE integration module. Mitigation: Upgrade to version 3.0.1 or later, which fixes the issue. + Alternatively, you can set the `org.apache.shiro.form-resubmit-host` (String) and `org.apache.shiro.form-resubmit-port` (Integer) system properties to restrict the host and port that Shiro will connect to when resubmitting a form.
2026-08-31 · score —
CVE-2026-77013
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms.
2026-08-31 · score —
CVE-2026-40465
NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter.
2026-08-31 · score —