Explore CVE records

MedPublished 29 Oct 2026, 20:07 WIB

CVE-2026-48195

WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 20:07 WIB

CVE-2026-113691

Stored Cross-Site Scripting in BMC ITSM Knowledge Articles

Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

Excerpt language: en.

MedPublished 29 Oct 2026, 20:06 WIB

CVE-2026-39741

WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a through 1.44.0.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 20:04 WIB

CVE-2026-48196

WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 20:04 WIB

CVE-2026-22386

WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 20:03 WIB

CVE-2026-52709

WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 20:03 WIB

CVE-2026-113690

Stored Cross-Site Scripting in BMC ITSM Attachments

Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute uploaded script content in other users' browsers.

Excerpt language: en.

CVSS4.8v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:05 WIB

Official record

MedPublished 29 Oct 2026, 20:02 WIB

CVE-2026-113689

Stored Cross-Site Scripting in BMC ITSM Work Notes

Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.

Excerpt language: en.

CVSS5.1v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:06 WIB

Official record

MedPublished 29 Oct 2026, 20:02 WIB

CVE-2026-24533

WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 20:01 WIB

CVE-2026-42703

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 20:01 WIB

CVE-2026-113688

Server-Side Request Forgery in BMC ITSM SmartIT

Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information.

Excerpt language: en.

CVSS5.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:06 WIB

Official record

MedPublished 29 Oct 2026, 20:01 WIB

CVE-2026-118087

WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 19:59 WIB

CVE-2026-118094

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 19:58 WIB

CVE-2026-39735

WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 19:58 WIB

CVE-2026-56056

WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 19:58 WIB

CVE-2026-118093

WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 19:47 WIB

CVE-2026-93006

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.8v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 19:47 WIB

Official record

MedPublished 29 Oct 2026, 19:47 WIB

CVE-2026-93007

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 19:47 WIB

Official record

MedPublished 29 Oct 2026, 19:47 WIB

CVE-2026-93011

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:07 WIB

Official record

HighPublished 29 Oct 2026, 19:37 WIB

CVE-2026-49142

OpenEMR Before 8.5.0 SQL Injection via form_icd_codes[]

OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 19:37 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage