CVE-2026-86583 Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip via display_name and nickname Profile Fields

The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.4.17 via the plugin's own export and re-import workflow. The vulnerability exists because the exporter writes CSV cells using fputcsv with a NUL byte \0 as...

CVE-2026-87899

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges...

CVE-2026-68492

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7...

EUVD-2026-85620

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts...

CVE-2026-87900

An argument injection vulnerability exists in the WP Toolkit for cPanel version 6.11.2-10794 and earlier. This flaw allows a remote authenticated user to perform database modifications in other accounts, which can include reading arbitrary files and executing arbitrary code across customer accoun...

EUVD-2026-85517

GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode to regular authenticated users without requiring an...

DRUPAL-CONTRIB-2026-188

This module enables you to combine multiple image styles into a single image derivative. The module does not sufficiently validate image style names when generating image derivatives. Under certain circumstances, this allows anonymous users to generate image derivatives without a valid token,...

CVE-2026-55610

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610 InvoiceShelf has cross-company user read/update IDOR that enables cross-tenant account takeover

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

EUVD-2026-85338

InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other...

CVE-2026-55610

In multi-company installations of InvoiceShelf prior to version 2.4.1 , an Insecure Direct Object Reference (IDOR) vulnerability allows any user with Owner privileges of one company to access other companies' data. The GET/PUT /api/v1/users/{user} endpoints resolve target users by a global primar...

CVE-2026-86681

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

WordPress Import and export users and customers plugin <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation vulnerability

Authenticated Subscriber+ Privilege Escalation vulnerability discovered by khanhnv in WordPress Plugin Import and export users and customers versions = 2.4.17...

CVE-2026-86681

ZohoCorp ManageEngine Applications Manager versions 182200 and below are affected by a permissions validation issue (Broken Access Control). This vulnerability allows low-privileged users to execute administrator-configured MBean actions on monitors that are outside of their assigned scope. No sp...

EUVD-2026-85289

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

CVE-2026-86681 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

CVE-2026-86681 Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope...

CVE-2026-5695 Multiple vulnerabilities in the Microweber administration panel

Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...