CVE-2026-84766

Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...

EUVD-2026-70561

Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...

CVE-2026-84766

An unauthenticated bypass vulnerability exists in the FluentBooking Pro WordPress plugin in versions 2.2.1 and below , as reported by Patchstack. The CVSS 3.1 score is 5.9 (Medium) , with a network attack vector, high complexity, no privileges required, and a high integrity impact but no confiden...

CVE-2026-84766 WordPress FluentBooking Pro plugin <= 2.2.1 - Bypass Vulnerability vulnerability

Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...

ManageEngine Password Manager Pro < Build 13235 SQLi (CVE-2026-14828)

According to its self-reported build number, the ManageEngine Password Manager Pro application running on the remote host is prior to build 13235. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious...

@docyrus/ui-pro-ai-assistant (>=0.8.4, <=0.14.9) potentially affected by CVE-2026-65842 via @platejs/docx-io (53.1.0)

@platejs/docx-io NPM version 53.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on @platejs/docx-io and may be impacted: - @docyrus/ui-pro-ai-assistant =0.8.4, =0.14.9 Source cves: CVE-2026-65842 Source advisory: OSV:GHSA-4Q39-2JHR-7QX8...

CVE-2026-14828

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...

CVE-2026-14828

Zohocorp ManageEngine products—Password Manager Pro (before 13235), PAM360 (before 8561), and Access Manager Plus (before 4405)—are vulnerable to an authenticated SQL Injection flaw. The CVSS 3.1 score is 8.8 (HIGH) with the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a network-exploit...

EUVD-2026-69888

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...

CVE-2026-14828

Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability...

CVE-2026-78657

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2026-14357

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

EUVD-2026-69872

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

CVE-2026-78657

The SigmaForms Pro – AI Generated Forms WordPress plugin (versions ≤ 1.4.11) is affected by an unauthenticated arbitrary file deletion vulnerability rooted in insufficient file path validation in the delete_submission_files function. An attacker submits a malicious path traversal URL via the plug...

CVE-2026-78657 SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field

The SigmaForms Pro – AI Generated Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deletesubmissionfiles function in all versions up to, and including, 1.4.11. This makes it possible for unauthenticated attackers to delete arbitra...

EUVD-2026-69873

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

CVE-2026-14357

The DevKit Pro plugin for WordPress is vulnerable to missing authorization in versions up to and including 2.3.0 . The root cause is a missing capability check and nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This allows authe...

CVE-2026-14357 DevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter

The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEVinstallthemesfunc function registered on the wpajaxDPDEVinstallthemes action. This makes it possib...

Malicious code in vitest-cli-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1262dc722ebac3b91301efde91e61df9ec9f65ccf91e51c15da53f9b518878b2 Package published as vitest-cli-pro ships a verbatim copy of nodemailer as cover; its declared postinstall runs lib/utils/index.js, which detaches a...

WordPress SigmaForms Pro plugin <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability

Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field vulnerability discovered by Doan Dinh Van in WordPress Plugin SigmaForms Pro – AI Generated Forms versions = 1.4.11...