PT-2026-71419

Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation...

CVE-2026-73533: Embedded Malicious Code

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file app/Library/updater/NinjaTableDataSync.php that established a backdoor REST API endpoint,...

CVE-2026-73532: Embedded Malicious Code

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-66429: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

CVE-2026-61980: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in OMGF Pro = 5.2.7 versions...

CVE-2026-66661: Incorrect Privilege Assignment

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

PT-2026-71586

Subscriber Privilege Escalation in Directories Pro = 2.0.5 versions...

PT-2026-71550

Subscriber SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.10 versions...

PT-2026-71397

Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection...

PT-2026-71689

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a require once directive added to fluentformpro.php...

Exploit for CVE-2026-44402

CVE-2026-44402 Pre-Authenticated Full Remote Command Executio...

WordPress Ninja Tables Pro plugin 5.2.11 - Backdoor vulnerability

Backdoor vulnerability discovered by ? in WordPress Plugin Ninja Tables Pro versions 5.2.11...

CVE-2026-15039

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

CVE-2026-15039 Gift Cards For WooCommerce Pro < 4.2.10 - Unauthenticated Arbitrary File Upload

The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution...

Malicious Package

Overview telebot-pro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious code in telebot-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e8fd9df00738115f53aef8944ede8d1f3d2daf360c2d227b54204ee62e8f89 On instantiation of TeleBot, the package spawns a background thread that copies the Telegram Desktop tdata directory from %APPDATA%\Telegram...

MAL-2026-13757 Malicious code in telebot-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e8fd9df00738115f53aef8944ede8d1f3d2daf360c2d227b54204ee62e8f89 On instantiation of TeleBot, the package spawns a background thread that copies the Telegram Desktop tdata directory from %APPDATA%\Telegram...

WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Directories Pro versions = 2.0.5...

CVE-2026-66409

DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot...