CVE-2026-23930 Frontend DoS via the popup.testtriggerexpr action

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

EUVD-2026-60735

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-23930

CVE-2026-23930 affects the Zabbix monitoring platform. An unauthenticated attacker can send specifically crafted requests to the Frontend popup.testtriggerexpr action, causing disproportionate CPU load on the Frontend webserver and leading to a potential denial of service . The NVD rates the vuln...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.10...

WordPress Frontend Admin by DynamiApps plugin <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter vulnerability

Unauthenticated Privilege Escalation via 'itemid' Parameter vulnerability discovered by 밥김국 - DDADDA in WordPress Plugin Frontend Admin by DynamiApps versions = 3.29.9...

PT-2026-76960

Name of the Vulnerable Software and Affected Versions Frontend affected versions not specified Description An authenticated user can cause excessive CPU load on the webserver by sending specially crafted requests to the 'validate.api.exists' API endpoint, which may result in a denial of service...

PT-2026-76957

Name of the Vulnerable Software and Affected Versions Frontend affected versions not specified Description An unauthenticated user can cause excessive CPU load on the webserver by sending specially crafted requests to the popup.testtriggerexpr action, which may result in a denial of service...

CVE-2026-23934: Asymmetric Resource Consumption (Amplification)

An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service...

CVE-2026-1199: Concurrent Execution using Shared Resource with Improper Synchronization

Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended...

CVE-2026-23930: Asymmetric Resource Consumption (Amplification)

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service...

CVE-2026-66638: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

PT-2026-77066

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-74254 Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend...

EUVD-2026-60304

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend...

CVE-2026-74254

CVE-2026-74254 is a SQL injection vulnerability in the Page Builder CK Joomla extension (by joomlack.fr), specifically in the styles model . The flaw allows an unauthenticated, remote attacker to interfere with database queries, potentially leading to data exfiltration, modification, or service d...

WordPress Frontend Admin by DynamiApps plugin < 3.29.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Frontend Admin by DynamiApps versions 3.29.9...

CVE-2026-17087

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...

CVE-2026-17087

The CVE describes an authorization bypass in the WP Travel Engine – Tour Booking Plugin (Tour Operator Software) for WordPress, up to version 6.8.4. An unauthenticated attacker can view private booking billing details (customer name, email, address, phone) by binding an arbitrary booking_id to th...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...

CVE-2026-18432

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.29.9. The vulnerability exists because ActionUser::conditionslogic gates the currentusercan'edituser', $userid authorization check behind an isnumeric test, causing...