CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

EUVD-2026-59849

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432

CVE-2026-18432 affects the Frontend Admin by DynamiApps plugin for WordPress (≤ 3.29.9). The flaw stems from ActionUser::conditions_logic() gating the current_user_can('edit_user', $user_id) check behind is_numeric(), so a non-numeric string (e.g., 1one) can bypass authorization when supplied via...

CVE-2026-18432 Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

PT-2026-73100

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditions logic gates the current user can'edit user', $user id authorization check behind an is numeric test,...

Linux Distros Unpatched Vulnerability : CVE-2026-72380

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xen/pvcalls: bound backend response reqid before indexing rsp pvcallsfronteventhandler takes reqid directly from the backend-supplied ring response and uses it ...

CVE-2026-67366

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

EUVD-2026-58806

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-67366 Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-67366

CVE-2026-67366 : The Joomla Extension icagenda.com (iCagenda) prior to 2.0.0-4.0.11 is affected by a CSRF issue on frontend registration actions. Multiple state-changing frontend operations can be triggered without a CSRF token check, enabling unauthorized changes. The CVSSv4 base score is 5.3 (M...

CVE-2026-67366 Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11

Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check...

CVE-2026-65937

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...

CVE-2026-65937

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...

EUVD-2026-57262

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...

CVE-2026-65937

CVE-2026-65937 affects WhatsUp Gold versions released before 2026.0.2. An authenticated attacker can bypass frontend controls and inject persistent script content via stored XSS vulnerabilities across the web UI. The CVSS3.1 score is 8.0 (HIGH) with adjacent attack vector, no privileges required,...

CVE-2026-67282

Joomla Extension - fabrikar.com - Unauthenticated remote code execution in Fabrik 4.6.8 - An unauthenticated attacker could execute arbitrary code by using the frontend listfilter model...

PT-2026-71118

Name of the Vulnerable Software and Affected Versions WhatsUp Gold versions prior to 2026.0.2 Description An authenticated attacker can bypass frontend controls to inject persistent script content. This allows for a stored cross-site scripting attack, where malicious scripts are permanently store...

CVE-2026-15606

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-15606

CVE-2026-15606 involves the WordPress plugin “Frontend Admin by DynamiApps.” All versions up to 3.29.9 are vulnerable to authorization bypass that lets authenticated users with subscriber-level permissions (or higher) reset any user’s password, including admins, risking full site takeover. The at...