CVE-2026-57499

Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The ipaddress parameter is embedded...

CVE-2025-62343

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

EUVD-2026-67035

OpenRemote versions before 1.28.0 contain a cross-realm information disclosure vulnerability in the Notification REST API that allows per-realm tenant administrators to read all tenants' sent notifications including message bodies. Attackers with read:admin credentials in one realm can submit a...

CVE-2026-81818

Flowintel (versions ≥3.3.0) contains an authorization flaw in the administrative user-edit API . The existing check prevented an organization administrator from editing users in another organization but did not block editing a full administrator within the same organization. This allowed an org a...

CVE-2026-81818 Flowintel Organization Administrator Can Reset Full Administrator Password and Escalate Privileges

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within the...

CVE-2026-81818

Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an organization administrator from editing users in another organization, but it did not prevent them from editing a full administrator within the...

EUVD-2025-210806

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

CVE-2025-62343 HCL IntelliOps Event Management is affected by multiple security vulnerabilities.

HCL IntelliOps Event Management IEM is affected by an Admin Session Concurrency Vulnerability. it may allows user sessions to remain active after logout or session deletion...

WordPress Forminator Forms plugin < 1.57.0.5 - Admin+ Network-Wide RCE via Hub Connector API Key on Multisite vulnerability

Admin+ Network-Wide RCE via Hub Connector API Key on Multisite vulnerability discovered by Jakub Herman in WordPress Plugin Forminator versions 1.57.0.5...

WordPress Admin Safety Guard plugin < 1.4.0 - Unauthenticated User Data Disclosure via 2fa/app/users REST Route vulnerability

Unauthenticated User Data Disclosure via 2fa/app/users REST Route vulnerability discovered by lodos2005 in WordPress Plugin Admin Safety Guard versions 1.4.0...

CVE-2026-78333

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

CVE-2026-59270

Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

EUVD-2026-66885

The 12 Step Meeting List WordPress plugin before 3.19.17 does not sanitise and escape a value submitted by unauthenticated users before storing it in its activity log and outputting it back in an admin area page, leading to a Stored Cross-Site Scripting issue which could be used against high...

CVE-2026-19454 JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data...

CVE-2026-19454

The JetBackup WordPress plugin (versions prior to 3.1.23.5 ) contains an incorrect authorization flaw. The plugin fails to perform a proper multisite authorization check before serving backup archives and job logs. This allows an administrator of the network's main site who lacks Super Admin priv...

CVE-2026-19454 JetBackup 3.1.18.8 - 3.1.23.3 - Admin+ Multisite Network Backup Download

The JetBackup WordPress plugin before 3.1.23.5 does not perform its multisite authorisation check before serving backup archives and job logs, allowing an administrator of the network's main site who is not a Super Admin to download a full backup of the entire network, including every site's data...

WordPress Smush plugin < 4.3.2 - Admin+ Network-Wide RCE vulnerability

Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Smush Image Compression and Optimization versions 4.3.2...

CVE-2026-19223 Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite

The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...

CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...

CVE-2026-77991 Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1

Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution...