PT-2026-102305

Name of the Vulnerable Software and Affected Versions Vehicle Manager Free versions prior to 6.5.8 Description Reflected Cross-Site Scripting occurs on the public vehicle-detail page when the task=view endpoint is used. The application echoes the title request parameter directly into a...

CVE-2026-100752: Improper Neutralization of Special Elements used in an SQL Command

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager Free 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate frontend property-listing queries category browsing, search results, and the full property listing from a request-controlled...

CVE-2026-102334: Improper Restriction of Excessive Authentication Attempts

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

PT-2026-102397

Name of the Vulnerable Software and Affected Versions Nginx Proxy Manager versions prior to 2.16.1 Description Non-administrator users with manage permissions can inject arbitrary nginx directives because the software fails to restrict the advanced config field to administrators. This allows...

PT-2026-99921

Name of the Vulnerable Software and Affected Versions SUSE Rancher Fleet versions 0.16 through 0.16.1 SUSE Rancher Fleet versions 0.15 through 0.15.6 SUSE Rancher Fleet versions 0.14 through 0.14.10 Description An issue exists in Rancher Manager where the Fleet agent utilizes its own cluster-admi...

PT-2026-102396

Name of the Vulnerable Software and Affected Versions Nginx Proxy Manager versions prior to 2.16.1 Description Lack of rate-limiting on authentication endpoints allows unauthenticated attackers to perform unlimited password guessing against any account. Attackers can brute-force login credentials...

CVE-2026-15953: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...

PT-2026-102304

Name of the Vulnerable Software and Affected Versions Vehicle Manager Free versions prior to 6.5.8 Description An unauthenticated SQL Injection exists in the site/vehiclemanager.php file. The issue occurs because the order field and order direction parameters are processed through a sanitizing...

PT-2026-102302

Name of the Vulnerable Software and Affected Versions Real Estate Manager Free versions prior to 6.7.9 Description Reflected Cross-Site Scripting occurs on the public property-detail page within the leave a review form. The title field repopulates directly from the request without escaping or...

PT-2026-99885

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager allows a attacker to execute arbitrary commands.

The vulnerability of the “record-output” parameter at the final destination /instances/$name/exec of the Docker control system and the Incus virtual machine manager is related to improper external management of file names or file paths. Exploiting this vulnerability allows a remote attacker to...

Exploit for Unrestricted Upload of File with Dangerous Type in Zohocorp Manageengine_Applications_Manager

CVE-2020-14008 — ManageEngine Applications Manager Remote Code...

CVE-2026-86609

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

CVE-2026-86609 Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

EUVD-2026-87889

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

CVE-2026-86609

The Download Manager WordPress plugin (versions before 7.5.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape data submitted via the email-locked download subscription form before it is outputted on an admin page. This flaw allows unauthe...

CVE-2026-86609 Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

Ivanti EPMM < 12.8.0.0 - Remote Code Execution

Ivanti Endpoint Manager Mobile contains a code injection vulnerability allowing unauthenticated attackers to execute arbitrary code remotely, exploit requires no authentication. id: CVE-2026-1340 info: name: Ivanti EPMM 12.8.0.0 - Remote Code Execution author: 0xAkoko severity: critical...

CVE-2026-86609: Improper Neutralization of Input During Web Page Generation

The Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form before outputting it back in an admin page, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against...

PT-2026-99494

Name of the Vulnerable Software and Affected Versions Download Manager WordPress plugin Pro edition versions prior to 7.5.6 Description The Pro edition of the plugin fails to sanitize and escape data submitted via the email-locked download subscription form before displaying it on an administrati...