7269 matches found
CVE-2026-53627 GLPI: Unexpected access to update operations through the API
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...
CVE-2026-93662
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
EUVD-2026-85809
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
CVE-2026-93662: Exposure of Sensitive Information to an Unauthorized Actor
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street...
CVE-2026-84706
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list an ANSIBLE prefix check plus a fixed ENVBLOCKLIST that omits process-hijacking loader variables such as BASHENV, ENV,...
CVE-2026-84706
A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates variable names against a deny-list an ANSIBLE prefix check plus a fixed ENVBLOCKLIST that omits process-hijacking loader variables such as BASHENV, ENV,...
CVE-2026-86679
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...
CVE-2026-86683
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...
CVE-2026-86678
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...
CVE-2026-86678
ZohoCorp ManageEngine Applications Manager versions 182000 and below are vulnerable to a broken authentication flaw. This vulnerability allows a low-privileged user to obtain an administrator’s API key , which can then be leveraged to perform administrator-level actions . Exploitation details and...
CVE-2026-86678 Broken Authentication vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...
EUVD-2026-85295
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...
CVE-2026-86677
ZohoCorp ManageEngine Applications Manager (versions 182000 and below) is vulnerable to a Broken Authentication issue caused by the improper neutralization of special elements in an SQL command . This flaw allows a low-privileged user to execute unauthorized SQL commands, which could lead to admi...
CVE-2026-86679 Broken Access Control vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...
CVE-2026-86679
ZohoCorp ManageEngine Applications Manager (versions 182000 and below ) is susceptible to a permissions validation issue . This vulnerability allows a low-privileged user to delete service monitors that are outside of their assigned scope. The documents do not provide specific details regarding t...
EUVD-2026-85293
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...
CVE-2026-86679 Broken Access Control vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...
CVE-2026-86683 Broken Authentication Vulnerability
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...