In ManageEngine ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus, the SSO tickets generated to authenticate that session could be predicted
by an unauthenticated user, leading to account takeover.
Zohocorp Zoho Mail wordpress plugin is vulnerable to Cross-Site request forgery (CSRF).
This issue affects Zoho Mail wordpress plugin versions before 1.6.2.
CVE-2026-2740 is a high-severity vulnerability in Zohocorp ManageEngine ADSelfService Plus and related products before specified versions. It involves improper neutralization of special elements in commands (CWE-77), leading to authenticated remote code execution on agent machines due to a flaw in a third-party dependency. The vulnerability requires low privileges and no user interaction but has a high attack complexity. No official patch or remediation guidance is currently confirmed. There are no known exploits in the wild at this time.
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
CVE-2026-5785 is a high-severity SQL injection vulnerability affecting Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230. The flaw exists in the query report module and requires authenticated access. Successful exploitation could lead to unauthorized disclosure and modification of data. No official patch or remediation guidance is currently provided. There are no known exploits in the wild at this time.
Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Zoho ZeptoMail: from n/a through 3.2.9.
Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subnet Details.
Missing Authorization vulnerability in zohocrm Zoho CRM Lead Magnet zoho-crm-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zoho CRM Lead Magnet: from n/a through <= 1.8.1.9.
Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an authorization issue in the initiate remote session functionality.
