CVE-2026-86708: Use of Hard-coded Cryptographic Key

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated...

CVE-2026-86683: Improper Input Validation

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-18872: Improper Neutralization of Input During Web Page Generation

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to stored cross-site scripting CWE-79 in the FTM UI NetworkAcknowledgement React component NetworkAcknowledgement.jsx:42. A malicious actor can inject script into stored network acknowledgement data that executes in...

PT-2026-97355

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Stored cross-site scripting occurs in the FTM UI NetworkAcknowledgement React component within the file NetworkAcknowledgement.jsx:42. A...

PT-2026-97332

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description An issue exists involving the use of non-canonical URL paths for authorization decisions. This allows an unauthenticated remote attacker to potentially...

CVE-2026-94079: Missing Authorization

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

PT-2026-97317

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can obtain an administrator API key, enabling them to execute actions with administrator-level privileges. Recommendations Update ManageEngine...

PT-2026-97454

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

PT-2026-97322

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks...

CVE-2026-18875: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Financial Transaction Manager FTM for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert CWE-74 in the FTM AI agent server api.vectordb.runbooks.js:51. An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer...

PT-2026-97351

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description An XML external entity XXE injection flaw allows a remote attacker to obtain sensitive information. XXE is a type of attack where an...

PT-2026-97333

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description Insufficient Session Expiration allows a low privileged attacker with adjacent network access to potentially achieve elevation of privileges, bypass...

PT-2026-97289

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.671 ManageEngine Network Configuration Manager versions prior to 12.8.671 Description An unauthorized Path Traversal issue exists, which allows an attacker to access files and directories outside t...

PT-2026-97340

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description An issue exists where authentication is missing for a critical function. This allows an unauthenticated attacker with remote access to potentially gain...

CVE-2026-18184: Improper Restriction of XML External Entity Reference

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to an XML external entity XXE injection flaw...

PT-2026-97193

Name of the Vulnerable Software and Affected Versions Booking Manager WordPress plugin versions prior to 2.1.21 Description Authenticated users with Author-level access and above can perform SQL injection attacks. This occurs because the plugin fails to sanitize and escape values retrieved from a...

PT-2026-97334

Name of the Vulnerable Software and Affected Versions Dell Secure Connect Gateway SCG Policy Manager versions prior to 5.34.00.16 Description An improper certificate validation issue exists where an unauthenticated attacker with adjacent network access can exploit the flaw. This may result in...

PT-2026-97356

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description The FTM AI agent server is susceptible to RAG poisoning, a technique where malicious data is injected into a Retrieval-Augmented Generation...

CVE-2026-86679: Improper Input Validation

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

PT-2026-97312

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182200 and earlier Description A permissions validation issue exists that allows low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope. MBeans...