CVE-2026-15606

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

EUVD-2026-56970

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-15606 Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-15606

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-15606

CVE-2026-15606 involves the WordPress plugin “Frontend Admin by DynamiApps.” All versions up to 3.29.9 are vulnerable to authorization bypass that lets authenticated users with subscriber-level permissions (or higher) reset any user’s password, including admins, risking full site takeover. The at...

CVE-2026-15606 Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-15426

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2026-15426

CVE-2026-15426 affects the WordPress plugin AcyMailing (

EUVD-2026-56857

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2026-15426 AcyMailing <= 10.11.1 - Authenticated (Subscriber+) Missing Authorization to Account Takeover via Notification Template Update

The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action...

CVE-2026-12571

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

CVE-2026-12571

The CVE-2026-12571 entry describes an authentication bypass in ManageEngine DDI Central’s password-reset workflow that enables account takeover. The NVD entry confirms a critical impact (CVSS 3.1: 9.8, NETWORK attack vector, no user interaction) with high impact on confidentiality, integrity, and...

CVE-2026-12571 Authentication Bypass Leading to Account Takeover

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

EUVD-2026-56557

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

CVE-2026-12571 Authentication Bypass Leading to Account Takeover

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...

CVE-2026-71326

A flaw was found in Traefik. The BasicAuth middleware in Traefik reuses a key for concurrent password checks, which is generated by concatenating the password and secret without a delimiter. An attacker with a valid credential and the corresponding stored hash can exploit this vulnerability to...

CVE-2025-49506

A flaw was found in Apache Portable Runtime Utility apr-util. The aprpasswordvalidate function does not perform constant-time comparisons for hashes or passwords. This vulnerability allows a remote attacker to conduct a timing attack, particularly on platforms without crypt such as Windows, BeOS,...

CVE-2026-46670

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...

CVE-2026-46670

YesWiki

CVE-2026-46670 YesWiki: Unauthenticated SQL Injection

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path FormManager::create allows any unauthenticated visitor of a default YesWiki install to inject arbitrary SQL into an INSERT statement and read the full database, includin...