EUVD-2026-85289

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

CVE-2026-86681

ZohoCorp ManageEngine Applications Manager versions 182200 and below are affected by a permissions validation issue (Broken Access Control). This vulnerability allows low-privileged users to execute administrator-configured MBean actions on monitors that are outside of their assigned scope. No sp...

EUVD-2026-85193

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...

EUVD-2026-85130

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition a...

CVE-2026-91792 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition a...

CVE-2026-91792 Foxit PDF Editor/Reader Annotation Use-After-Free Remote Code Execution Vulnerability

When processing a specially crafted PDF, Foxit PDF Editor/Reader may perform reentrant zoom and layout operations through page- and annotation-related JavaScript actions. This can cause the application to access page objects after they have been released, resulting in a use-after-free condition a...

CVE-2026-91792

Foxit PDF Editor/Reader is vulnerable to a use-after-free condition when processing a specially crafted PDF. The vulnerability is triggered when the application performs reentrant zoom and layout operations through page- and annotation-related JavaScript actions, causing it to access page objects...

CVE-2026-87981

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

CVE-2026-18364

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

EUVD-2026-85054

The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not bind one of its unauthenticated payment actions to the requesting user, allowing someone who holds another member's in-flight payment identifier to delete that member's checkout state...

CVE-2026-87981

The Paymob for WooCommerce WordPress plugin, in versions prior to 4.1.14 , contains a vulnerability where it fails to perform sufficient capability checks on several admin AJAX actions . This oversight allows users with contributor-level access to delete, wipe, or modify the payment-gateway confi...

CVE-2026-87981 Paymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions

The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment...

EUVD-2026-85042

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

CVE-2026-18364

The zportals WordPress plugin versions prior to 6.4.2 is vulnerable to an unauthorized settings modification. The root cause is the failure to perform capability or nonce checks on several AJAX actions . This allows users with low-privileged subscriber-level accounts to modify the plugin's stored...

EUVD-2026-85022

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

EUVD-2026-84959

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and trigger unauthorized actions due to server-side request forgery...

EUVD-2026-84958

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper authentication and missing authorization...

EUVD-2026-84964

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a local attacker to obtain sensitive information and perform unauthorized actions due to insufficiently protected credentials...

EUVD-2026-84967

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote attacker to perform unauthorized actions due to improper configuration of HTTP method-based security constraints...

PT-2026-97356

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description The FTM AI agent server is susceptible to RAG poisoning, a technique where malicious data is injected into a Retrieval-Augmented Generation...