WordPress JS Help Desk plugin < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload vulnerability

Unauthenticated Arbitrary Ticket File Attachment Upload vulnerability discovered by Shivamani Vastrala in WordPress Plugin JS Help Desk versions 3.1.4...

WordPress JS Help Desk plugin < 3.1.4 - Subscriber+ Sensitive Information Disclosure vulnerability

Subscriber+ Sensitive Information Disclosure vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin JS Help Desk versions 3.1.4...

GHSA-G2R8-WVMJ-JF5W `nx graph` dev server permissive CORS policy

Summary The local HTTP server started by nx graph sent Access-Control-Allow-Origin: on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help...

`nx graph` dev server permissive CORS policy

Summary The local HTTP server started by nx graph sent Access-Control-Allow-Origin: on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help...

EUVD-2026-39831

nx graph dev server permissive CORS policy...

Kwetsbaarheid verholpen in SolarWinds Web Help Desk

SolarWinds has identified a vulnerability in the SolarWinds Web Help Desk’s authentication mechanism. This vulnerability involves an attempt to bypass the authentication process using SAML 2.0. This issue occurs in systems where SAML authentication is enabled. An attacker can exploit this...

CVE-2026-14930

The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions and attach them to...

CVE-2026-15209

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

CVE-2026-14928

The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user Subscriber and above to read the subject and full message body of every other user's support...

CVE-2026-14929

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...

CVE-2026-14931

The JS Help Desk WordPress plugin, in versions prior to 3.1.4 , contains a vulnerability where the Contributor role is granted the support-agent capability upon activation. Due to a missing capability check on a user-listing handler , users with Contributor-level privileges can enumerate the emai...

WordPress JS Help Desk plugin < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure vulnerability

Subscriber+ Cross-User Support Ticket Disclosure vulnerability discovered by Sai Praneeth Koti in WordPress Plugin JS Help Desk versions 3.1.5...

CVE-2026-15209 JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

CVE-2026-15209

The JS Help Desk WordPress plugin versions prior to 3.1.5 is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The application fails to verify if a requesting user owns the ticket being loaded. Consequently, a low-privileged authenticated user can provide a different user's ticket ID...

CVE-2026-15209 JS Help Desk – AI-Powered Support & Ticketing System < 3.1.5 - Subscriber+ Cross-User Support Ticket Disclosure via IDOR

The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body...

CVE-2026-14931 JS Help Desk < 3.1.4 - Contributor+ User Email Disclosure

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

CVE-2026-14931

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

WordPress JS Help Desk plugin < 3.1.4 - Contributor+ User Email Disclosure vulnerability

Contributor+ User Email Disclosure vulnerability discovered by Vaibhav Narkhede in WordPress Plugin JS Help Desk versions 3.1.4...

CVE-2026-14929 JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...

EUVD-2026-51422

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...