Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Vendor: GFI USA, LLC Clear all filters
TI-2026-82010 CVE-2026-112357 · GHSA-mcj5-656f-pmhr

Privilege escalation in GFI KerioConnect KOFF via weak installer permissions

Priority LOW 38

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product director…

CVSS 4.0HIGH 8.5 Local Low privileges No interaction EPSS 0.00129 Published 2026-10-28 Fixed in 10.0.9p2 CWE-276
TI-2026-82009 CVE-2026-112356 · GHSA-53x6-q8p5-wm6r

Cross-site scripting in GFI KerioConnect via link auto-formatter

Priority LOW 23

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered…

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0025 Published 2026-10-28 Fixed in 10.0.9p2 CWE-79
TI-2026-81415 CVE-2026-112353 · GHSA-x85g-q7vc-7jh7

Stored cross-site scripting in GFI KerioConnect Webmail

Priority LOW 27

GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail ses…

CVSS 4.0MEDIUM 6.2 Network No auth User interaction EPSS 0.00243 Published 2026-10-27 Fixed in 10.0.8p2 CWE-79