PT-2026-86872

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

Linux Distros Unpatched Vulnerability : CVE-2026-86090

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users ca...

CVE-2026-86500: Incorrect Privilege Assignment

In JetBrains YouTrack before 2026.1.14047 a missing escalation check let a user with project update permissions grant themselves Project Admin...

PT-2026-86757

Name of the Vulnerable Software and Affected Versions FreeIPA versions prior to 4.13.4 Description A flaw exists in the self-managed OTP token Access Control Instruction ACI, which does not require authentication and fails to restrict the attributes that can be added alongside a token entry. An...

Linux Distros Unpatched Vulnerability : CVE-2026-86091

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools an...

CVE-2026-86437: Incorrect Authorization

Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowing non-Superadmin administrators to upload and extract arbitrary zip archives over the live application source code. Attackers can upload a malicious archive...

CVE-2026-86165

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and cou...

CVE-2026-75816

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816

The Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.12 ) is vulnerable to unauthenticated account takeover via an authentication bypass. The root cause lies in the pre_update_value function lacking a capability or ownership check, combined with ActionPost::con...

CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

EUVD-2026-72044

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816: Improper Authentication

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-86222: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqliquery of the file /admin/modaladdcourse2.php. Such manipulation of the argument course leads to sql injection. The attack may be launched remotely. The exploit has been disclose...

CVE-2026-86223: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This impacts the function mysqliquery of the file /admin/modaladdcoursea.php. Performing a manipulation of the argument course results in sql injection. Remote exploitation of the attack is possible. The exploit ha...

CVE-2026-86224: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqliquery of the file /admin/modaladdproduct.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-86225: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is the function mysqliquery of the file /admin/modaladdroom.php. The manipulation of the argument roomname leads to sql injection. The attack is possible to be carried out...

Exploit for CVE-2026-19598

CVE-2026-19598 — Pods WordPress Plugin Unauthenticated Privile...

CVE-2026-86193

grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-super accounts to gain full administrative...

CVE-2026-86195 grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag

grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manager with api.access and api.users.write...