WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Photo Album Plus versions = 9.3.02.002...

CVE-2026-93774: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Photo Album Plus = 9.3.02.002 versions...

PT-2026-97453

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions prior to 9.3.02.003 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

CVE-2026-75791

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-74849

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

CVE-2026-75791 Authentication bypass vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-75791

ManageEngine ADSelfService Plus (by Zohocorp) versions before build 7001 are affected by an authentication bypass in its REST API . The vulnerability allows unauthenticated remote attackers to bypass authentication, with a CVSS 3.1 score of 8.6 (HIGH) — low attack complexity, no privileges or use...

CVE-2026-75791 Authentication bypass vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

EUVD-2026-84364

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-74849 Remote code execution vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

CVE-2026-74849 Remote code execution vulnerability

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

CVE-2026-74849

Zohocorp ManageEngine ADSelfService Plus versions prior to build 7001 contain a remote code execution vulnerability in the GINA client . The CNA-assigned CVSS v3.1 score is 9.8 (CRITICAL) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploitable flaw requiring no authentic...

PT-2026-96713

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to build 7001 Description An authentication bypass exists in the REST API, allowing an attacker to gain unauthorized access to the system. Recommendations Update ManageEngine ADSelfService Plus to...

PT-2026-96712

Name of the Vulnerable Software and Affected Versions ManageEngine ADSelfService Plus versions prior to build 7001 Description A remote code execution issue exists in the GINA client, which could lead to full system compromise. Recommendations Update to build 7001...

CVE-2026-75791: Missing Authentication for Critical Function

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API...

CVE-2026-74849: Improper Neutralization of Special Elements used in an OS Command

Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client...

nginx 1.3.0 < 1.28.2 / 1.29.x < 1.29.5 SSL Upstream Injection

A vulnerability exists in NGINX OSS and NGINX Plus when configured to proxy to upstream Transport Layer Security TLS servers. An attacker with a man-in-the-middle MITM position on the upstream server side—along with conditions beyond the attacker's control—may be able to inject plain text data in...

Nginx Out-of-band Security Notification (July 15, 2026)

NGINX Security Advisory: NGINX Ingress Controller vulnerability CVE-2026-55723 NGINX Ingress Controller NGINX Ingress Controller vulnerability CVE-2026-52865 NGINX Ingress Controller NGINX Agent vulnerability CVE-2026-60062 NGINX Agent, NGINX Instance Manager NGINX map directive and regex matchin...

WordPress WP Support Plus Responsive Ticket System plugin <= 9.1.2 - Unauthenticated Stored XSS via File Upload vulnerability

Unauthenticated Stored XSS via File Upload vulnerability discovered by Ayush Srivastava in WordPress Plugin WP Support Plus Responsive Ticket System versions = 9.1.2...

MAL-2026-16318 Malicious code in @asenfotech/unplugin-element-plus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...