CVE-2026-88619

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

PT-2026-92046

1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes scheduled-job management endpoints without method-level permission checks, allowing a low-privileged authenticated user to access functionality...

CVE-2026-88619

The 1024-lab SmartAdmin v3.30.0 software contains a missing authorization vulnerability within the scheduled-job management module . Specifically, the AdminSmartJobController fails to implement method-level permission checks on scheduled-job management endpoints. This oversight allows a low-privi...

Astra Linux – Vulnerability in Firefox and Thunderbird

During operations on MessageTasks, a task may be removed while it is still scheduled, resulting in memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird 78.15, Thunderbird 91.2, Firefox ESR 91.2, Firefox ESR 78.15, and Firefox 93...

CVE-2026-87870

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-75230

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-87870

The Ninja Forms – Scheduled Exports plugin for WordPress (all versions up to and including 3.0.3 ) is vulnerable to Stored Cross-Site Scripting via unsanitized REST API parameters (interval , format , emailTo ). The root cause is insufficient input sanitization and output escaping, compounded by ...

PT-2026-89258

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-87870: Improper Neutralization of Input During Web Page Generation

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

Kibana 9.4.x < 9.4.4 Information Disclosure (ESA-2026-161)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.4. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-161 advisory. - Observable Response Discrepancy CWE-204 in the Kibana Osquery feature can lead to information disclosure via Query System for...

EUVD-2026-72675

Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is normally limited to system maintainers. As a consequence, this...

WordPress Ninja Forms - Scheduled Exports plugin <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters vulnerability

WordPress Ninja Forms - Scheduled Exports plugin = 3.0.3 - Authenticated Subscriber+ Stored Cross-Site Scripting via REST API Parameters vulnerability discovered by Nguyen Truong Roll in WordPress Plugin Ninja Forms - Scheduled Exports versions = 3.0.3...

CVE-2026-86177

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-86177 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-86177

Pterodactyl Panel versions before 1.14.1 fail to validate action-specific permissions when creating scheduled tasks. A subuser holding only the schedule.update permission can create and immediately trigger scheduled tasks that execute arbitrary game-server console commands , control server power ...

EUVD-2026-71976

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-86177 Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-86177: Missing Authorization

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

PT-2026-86401

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console command...

CVE-2026-85040

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...