Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
647 results · page 1 of 13
Oct 13, 2026Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.CVE-2026-14308 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 4.9
Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.
- Product
- ManageEngine Malware Protection Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL dCVE-2026-12265 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
- Product
- DDI Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code executioCVE-2026-12264 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.
- Product
- DDI Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow.CVE-2026-12269 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
- Product
- DDI Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.CVE-2026-12268 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
- Product
- DDI Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 28, 2026ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code executCVE-2026-12267 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.2
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.
- Product
- DDI Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 24, 2026ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector uCVE-2026-92905 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.3
ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets.
- Product
- ManageEngine EventLog Analyzer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the ApplicatioCVE-2026-86708 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 10
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.
- Product
- ManageEngine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.CVE-2026-86683 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings.
- Product
- ManageEngine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execCVE-2026-86681 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.6
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to a permissions validation issue that allowed low-privileged users to execute administrator-configured MBean actions on monitors outside their assigned scope.
- Product
- ManageEngine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delCVE-2026-86679 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.1
ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.
- Product
- ManageEngine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform adCVE-2026-86678 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions.
- Product
- ManageEngine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining adminisCVE-2026-86677 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.
- Product
- ManageEngine Applications Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslCVE-2026-76980 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.4
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking CompareCVE-2026-76979 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.7
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to an XML Injection vulnerability in the Rule Tracking Compare Policies feature.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings CVE-2026-76978 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in the Diagnose Settings feature.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerabilitCVE-2026-75825 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication Bypass vulnerability.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.CVE-2026-19599 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 9.9
ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile module.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an autheCVE-2026-84791 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.1
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to modify Change Management report schedule configurations for firewalls outside their assigned scope.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an autheCVE-2026-84789 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.1
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Broken Access Control vulnerability that allowed an authenticated low-privilege user to create alert notifications for firewalls outside their assigned scope.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenCVE-2026-84787 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability that allowed an authenticated low-privilege user to gain Administrator privileges through Report Profile import.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.CVE-2026-15358 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.5
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search ReCVE-2026-14913 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 23, 2026ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template InjecCVE-2026-12370 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.6
ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution.
- Product
- ManageEngine OpManager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.CVE-2026-75791 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.6
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to an authentication bypass vulnerability in the REST API.
- Product
- ManageEngine ADSelfService Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 22, 2026Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.CVE-2026-74849 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 9.8
Zohocorp ManageEngine ADSelfService Plus versions before build 7001 are vulnerable to a remote code execution vulnerability in the GINA client.
- Product
- ManageEngine ADSelfService Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execCVE-2026-18912 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.7
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module.
- Product
- ManageEngine DataSecurity Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 18, 2026ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without properCVE-2026-18911 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.5
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.
- Product
- ManageEngine DataSecurity Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated ComponentCVE-2026-85640 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
Zohocorp ManageEngine Endpoint Central versions below 11.5.2600.15 are vulnerable to Privilege Escalation Due to Outdated Component
- Product
- ManageEngine Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.CVE-2026-77699 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5
Zohocorp ManageEngine Endpoint Central versions below 11.5.2605.01 are vulnerable to Local privilege escalation due to loading a dll from an untrusted path.
- Product
- ManageEngine Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR ExtractionCVE-2026-77697 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 6.3
Zohocorp ManageEngine Endpoint Central versions below 11.4.2540.23 are vulnerable to Privilege Escalation During JAR Extraction
- Product
- ManageEngine Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 7, 2026Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.CVE-2026-77698 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 5.7
Zohocorp ManageEngine Endpoint Central versions before 11.5.2605.01 are vulnerable to local privilege escalation due to Agent upgrade.
- Product
- ManageEngine Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 2, 2026Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to anCVE-2026-14828 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 are vulnerable to an authenticated SQL Injection vulnerability.
- Product
- ManageEngine Password Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due toCVE-2026-12263 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation.
- Product
- ManageEngine Password Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.CVE-2026-11840 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.8
Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection.
- Product
- ManageEngine Password Manager Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.CVE-2026-12571 · Email & office · zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 9.8
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
- Product
- manageengine_ddi_central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2026Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange OnlineCVE-2026-16053 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.5
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
- Product
- ManageEngine M365 Manager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 23, 2026Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.CVE-2026-6516 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 10
Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API.
- Product
- ManageEngine ADAudit Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.CVE-2026-3183 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.1
Zohocorp ManageEngine ADSelfService Plus versions before 6524 are vulnerable to Multi Factor Authentication Bypass.
- Product
- ManageEngine ADSelfService Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 21, 2026Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.CVE-2026-3182 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Medium 4.3
Zohocorp ManageEngine Endpoint Central versions before 11.4.2528.34 are affected by cleartext transmission of sensitive information vulnerability.
- Product
- ManageEngine Endpoint Central
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2026In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be pCVE-2026-11374 · Email & office · zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02Critical 9
In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted by an unauthenticated user, leading to account takeover.
- Product
- manageengine_adselfservice_plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 21, 2026Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to AuthenticatedCVE-2026-2740 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.4
Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency.
- Product
- ManageEngine ADSelfService Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.CVE-2026-3324 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.2
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
- Product
- ManageEngine Log360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 16, 2026Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injectioCVE-2026-5785 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 8.1
Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in the query report module.
- Product
- ManageEngine PAM360
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.CVE-2026-27655 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.CVE-2026-4108 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.CVE-2026-4107 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.CVE-2026-3880 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.CVE-2026-3879 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 3, 2026Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.CVE-2026-28703 · Email & office · Zohocorp · reported by 0fc0942c-577d-436f-ae8e-945763c79b02High 7.3
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
- Product
- ManageEngine Exchange Reporter Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.