GHSA-RR49-F9G6-C9R5 plone.app.portlets Vulnerable to Remote Code Execution via TALES Injection

Impact The Classic portlet plone.app.portlets.portlets.classic used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet...

CVE-2026-86678

ZohoCorp ManageEngine Applications Manager versions 182000 and below are vulnerable to a broken authentication flaw. This vulnerability allows a low-privileged user to obtain an administrator’s API key , which can then be leveraged to perform administrator-level actions . Exploitation details and...

CVE-2026-86678 Broken Authentication vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions...

EUVD-2026-85295

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution...

CVE-2026-86677

ZohoCorp ManageEngine Applications Manager (versions 182000 and below) is vulnerable to a Broken Authentication issue caused by the improper neutralization of special elements in an SQL command . This flaw allows a low-privileged user to execute unauthorized SQL commands, which could lead to admi...

CVE-2026-86679 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

CVE-2026-86679 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

CVE-2026-86679

ZohoCorp ManageEngine Applications Manager (versions 182000 and below ) is susceptible to a permissions validation issue . This vulnerability allows a low-privileged user to delete service monitors that are outside of their assigned scope. The documents do not provide specific details regarding t...

EUVD-2026-85293

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope...

EUVD-2026-85291

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86683 Broken Authentication Vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-86683 Broken Authentication Vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings...

CVE-2026-84789 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

EUVD-2026-85261

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

CVE-2026-84789 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope...

EUVD-2026-85260

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

CVE-2026-84791 Broken Access Control vulnerability

ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope...

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Frontend versions = 4.3.11...

WordPress WP User Frontend plugin <= 4.3.11 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Frontend versions = 4.3.11...

WordPress WP User Frontend plugin <= 4.3.11 - Bypass Vulnerability vulnerability

Bypass Vulnerability vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Frontend versions = 4.3.11...