CVE-2026-86842 Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...

CVE-2026-18364

The zportals WordPress plugin versions prior to 6.4.2 is vulnerable to an unauthorized settings modification. The root cause is the failure to perform capability or nonce checks on several AJAX actions . This allows users with low-privileged subscriber-level accounts to modify the plugin's stored...

CVE-2026-18364 Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

EUVD-2026-85022

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

CVE-2026-18364 Zportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

WordPress zportals plugin < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update vulnerability

Subscriber+ Arbitrary Plugin Settings Update vulnerability discovered by Erwan LR WPScan in WordPress Plugin Zportals versions 6.4.2...

CVE-2026-86683: Improper Input Validation

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

PT-2026-97307

Name of the Vulnerable Software and Affected Versions ManageEngine OpManager versions prior to 12.8.710 ManageEngine Firewall Analyzer versions prior to 12.8.710 Description A command injection issue exists within the Diagnose Settings feature. Command injection is a flaw that allows an attacker ...

PT-2026-97158

Name of the Vulnerable Software and Affected Versions zportals WordPress plugin versions prior to 6.4.2 Description The plugin fails to perform capability or nonce checks on several AJAX actions. This allows users with subscriber-level accounts to modify stored integration settings. A nonce is a...

PT-2026-97268

Name of the Vulnerable Software and Affected Versions Microweber affected versions not specified Description Reflected Cross-Site Scripting XSS occurs in the administration panel. The issue exists within the /admin/settings endpoint via the group parameter. An attacker can trick an authenticated...

PT-2026-97624

Name of the Vulnerable Software and Affected Versions pmTicket Project-Management-Software versions up to 078fa56a782490c5059a0814f84df27984f4d7e2 Description A remote SQL injection is possible due to improper handling of the conn settings argument within the setSync function of the '/ajax/add...

PT-2026-97194

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

PT-2026-97319

Name of the Vulnerable Software and Affected Versions ManageEngine Applications Manager versions 182000 and earlier Description A low-privileged user can modify the proxy settings of the application. Recommendations Update to a version later than 182000...

CVE-2026-76978: Improper Neutralization of Special Elements used in an OS Command

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature...

CVE-2026-91025: Authorization Bypass Through User-Controlled Key

The Booking Manager WordPress plugin before 2.1.21 does not verify that a request to modify a user's Booking Manager WordPress plugin before 2.1.21-specific settings targets the requesting user's own account, allowing any authenticated user with subscriber-level access and above to create or...

CVE-2026-86842: Missing Authorization

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be...

CVE-2026-18364: Missing Authorization

The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings...

Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-161

The Webform module allows site builders to create forms, collect submissions, and configure access to forms and submission data. Webform includes a submodule called Webform Entity Print. This submodule doesn't sufficiently limit access to its print templates. When the submodule is enabled, a user...

PT-2026-97655

Name of the Vulnerable Software and Affected Versions Drupal Webform Entity Print submodule affected versions not specified Description The Webform Entity Print submodule does not sufficiently limit access to its print templates. A user with permissions to create and edit their own webforms can...

Linux Distros Unpatched Vulnerability : CVE-2026-92019

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153....