EUVD-2026-85237

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...

CVE-2026-15358

ZohoCorp ManageEngine OpManager and Network Configuration Manager versions prior to 12.8.671 are susceptible to an unauthorized Path Traversal vulnerability. This flaw allows for unauthorized access to restricted file system paths. Specific exploitation details and links are not provided in the d...

CVE-2026-12370

ZohoCorp ManageEngine OpManager , NetFlow Analyzer , and Network Configuration Manager (versions 12.8.667 and below) are vulnerable to a Server-Side Template Injection vulnerability. This flaw exists during Configlet processing and could lead to Remote Code Execution . While the impact is signifi...

EUVD-2026-85228

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution...

CVE-2026-12370 Remote Code Execution Vulnerability

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution...

CVE-2026-12370 Remote Code Execution Vulnerability

ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution...

WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin PixelYourSite – Your smart PIXEL TAG Manager versions = 11.4.1...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2026-11979 DESCRIPTION: libxml2 is vulnerable to multiple stack-based buffer overflows in the xmlcatalog utility when running in --shell mode. The usershell functi...

CVE-2026-91025

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-91077

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-91024

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

CVE-2026-91077 Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

EUVD-2026-85059

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

WordPress Event Booking Manager for WooCommerce plugin 5.3.6-5.7.2 - Contributor+ Unpublished Event Disclosure vulnerability

Contributor+ Unpublished Event Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.3.6-5.7.2...

CVE-2026-91077 Event Booking Manager for WooCommerce 5.3.6 - 5.7.2 - Contributor+ Unpublished Event Disclosure via mpwem_load_event_list

The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event...

CVE-2026-91077

The Event Booking Manager for WooCommerce WordPress plugin (versions 5.3.6 - 5.7.2 ) is vulnerable to an Improper Access Control issue. The plugin fails to restrict its event listing query, allowing users with contributor-level access and above to retrieve private, draft, and trashed events belon...

CVE-2026-91024 Booking Manager < 2.1.21 - Author+ SQLi via ICS Import Feed UID (sync_gid)

The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control...

WordPress Booking Manager plugin < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification vulnerability

Subscriber+ Arbitrary User Plugin Meta Modification vulnerability discovered by Choriyev Qahramon ciprobe in WordPress Plugin Booking Manager versions 2.1.21...

WordPress Booking Manager plugin < 2.1.21 - Author+ SQLi vulnerability

Author+ SQLi vulnerability discovered by Mohamed Bassia in WordPress Plugin Booking Manager versions 2.1.21...

CVE-2026-91025 Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...