Read the docs

MyComplianceOffice

Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

MyComplianceOffice records in CISA KEV

No MyComplianceOffice vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Mycomplianceoffice 7 records LOW Mco 1 record LOW

Records

8 records

TI-2026-38884 CVE-2026-53908 · GHSA-59mp-p3m2-6wr7

User Enumeration in MCO

Priority LOW 36

MCO is vulnerable to User Enumeration through authentication-related functionalities.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00361 Published 2026-07-01 No fix listed CWE-204
TI-2026-38878 CVE-2026-53902 · GHSA-rgv6-j8h9-46fv

Privilege Escalation in MCO

Priority LOW 31

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/profile-sections/group-membership endpoint.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00342 Published 2026-07-01 No fix listed CWE-266
TI-2026-38880 CVE-2026-53904 · GHSA-4p9c-w7qw-q5pq

Account Denial of Service in MCO

Priority LOW 28

MCO is vulnerable to Account Denial of Service due to improper implementation of password reset functionality.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00341 Published 2026-07-01 No fix listed CWE-307
TI-2026-38885 CVE-2026-53909 · GHSA-5v97-p7p8-r448

Arbitrary File Upload in MCO

Priority LOW 24

MCO does not correctly validate types of uploaded files.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00394 Published 2026-07-01 No fix listed CWE-434
TI-2026-38882 CVE-2026-53906 · GHSA-qwcf-5293-mm28

Path Disclosure and Path Traversal in MCO

Priority LOW 24

MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.0052 Published 2026-07-01 No fix listed CWE-209
TI-2026-38881 CVE-2026-53905 · GHSA-4hjp-j24w-p3rr

Unauthorized Access to Administrator ACL View in MCO

Priority LOW 24

MCO does not properly enforce authorization checks in the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00317 Published 2026-07-01 No fix listed CWE-863
TI-2026-38879 CVE-2026-53903 · GHSA-h63w-8j45-g3cx

Insecure Direct Object Reference in MCO

Priority LOW 24

MCO is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00407 Published 2026-07-01 No fix listed CWE-639
TI-2026-38883 CVE-2026-53907 · GHSA-r38x-66p9-p239

Stored Cross‑Site Scripting in MCO

Priority LOW 22

MCO is vulnerable to Stored Cross‑Site Scripting (XSS) via the application logo upload functionality.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00241 Published 2026-07-01 No fix listed CWE-79
Open these records in search →