Explore CVE records

MedPublished 29 Oct 2026, 21:17 WIB

CVE-2026-118092

WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability

Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:17 WIB

Official record

MedPublished 29 Oct 2026, 21:16 WIB

CVE-2026-116406

WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.

Excerpt language: en.

MedPublished 29 Oct 2026, 21:15 WIB

CVE-2026-52708

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:15 WIB

Official record

MedPublished 29 Oct 2026, 21:14 WIB

CVE-2026-116846

WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:14 WIB

Official record

MedPublished 29 Oct 2026, 21:13 WIB

CVE-2026-48884

WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:14 WIB

Official record

MedPublished 29 Oct 2026, 21:12 WIB

CVE-2026-80069

MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site reques…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:12 WIB

Official record

MedPublished 29 Oct 2026, 21:11 WIB

CVE-2026-80067

MasterStudy LMS WordPress Plugin < 3.7.50 Path Traversal via stm_lms_step Parameter

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capabil…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:11 WIB

Official record

HighPublished 29 Oct 2026, 21:10 WIB

CVE-2026-115713

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Modification

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:10 WIB

Official record

MedPublished 29 Oct 2026, 21:10 WIB

CVE-2026-115712

Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings

Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that on…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:10 WIB

Official record

MedPublished 29 Oct 2026, 21:10 WIB

CVE-2026-115711

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Credential Disclosure

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform com…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:10 WIB

Official record

HighPublished 29 Oct 2026, 21:10 WIB

CVE-2026-115709

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Information Disclosure and Data Loss

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).

Excerpt language: en.

CVSS8.2v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:10 WIB

Official record

HighPublished 29 Oct 2026, 21:10 WIB

CVE-2026-115708

Improper Link Resolution Before File Access ('Link Following') in Elastic Cloud Enterprise (ECE) Leading to Authentication Bypass

Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).

Excerpt language: en.

CVSS7.2v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:10 WIB

Official record

MedPublished 29 Oct 2026, 21:09 WIB

CVE-2026-115707

Insertion of Sensitive Information into Externally-Accessible File or Directory in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation

Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certific…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.4v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:09 WIB

Official record

MedPublished 29 Oct 2026, 21:09 WIB

CVE-2026-115706

Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation

Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attack…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.8v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:09 WIB

Official record

HighPublished 29 Oct 2026, 21:08 WIB

CVE-2026-39736

WordPress JetEngine plugin <= 3.9.0.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:12 WIB

Official record

MedPublished 29 Oct 2026, 21:05 WIB

CVE-2026-116402

WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:07 WIB

Official record

MedPublished 29 Oct 2026, 20:58 WIB

CVE-2026-118425

Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback

A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.8v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:58 WIB

Official record

MedPublished 29 Oct 2026, 20:58 WIB

CVE-2026-48202

WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:59 WIB

Official record

MedPublished 29 Oct 2026, 20:56 WIB

CVE-2026-39782

WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability

Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:56 WIB

Official record

MedPublished 29 Oct 2026, 20:55 WIB

CVE-2026-25467

WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:55 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage