Explore CVE records

HighPublished 29 Oct 2026, 20:54 WIB

CVE-2026-116399

WordPress InstaWP Connect plugin <= 0.1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affects InstaWP Connect: from n/a through 0.1.4.2.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:55 WIB

Official record

MedPublished 29 Oct 2026, 20:53 WIB

CVE-2026-116857

WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.

Excerpt language: en.

MedPublished 29 Oct 2026, 20:31 WIB

CVE-2026-113697

Reflected Cross-Site Scripting in BMC Helix Operations Management

Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.

Excerpt language: en.

CVSS4.8v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:49 WIB

Official record

MedPublished 29 Oct 2026, 20:29 WIB

CVE-2026-113696

Improper Authorization in BMC ITSM SmartIT Change Approvals

Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approval restrictions.

Excerpt language: en.

CVSS5.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:49 WIB

Official record

MedPublished 29 Oct 2026, 20:14 WIB

CVE-2026-113695

Reflected Cross-Site Scripting in BMC ITSM SmartIT

Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by another user.

Excerpt language: en.

CVSS4.8v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:50 WIB

Official record

MedPublished 29 Oct 2026, 20:13 WIB

CVE-2026-93009

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not re…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:13 WIB

Official record

MedPublished 29 Oct 2026, 20:13 WIB

CVE-2026-93010

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:13 WIB

Official record

MedPublished 29 Oct 2026, 20:12 WIB

CVE-2026-113694

Improper Authorization in BMC ITSM SmartIT Attachments

Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.

Excerpt language: en.

CVSS5.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:51 WIB

Official record

MedPublished 29 Oct 2026, 20:09 WIB

CVE-2026-113693

System Account Credential Disclosure in BMC ITSM

Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to retrieve a system username and encrypted password value.

Excerpt language: en.

CVSS5.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:59 WIB

Official record

MedPublished 29 Oct 2026, 20:09 WIB

CVE-2026-54862

WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

MedPublished 29 Oct 2026, 20:08 WIB

CVE-2026-113692

Path Traversal in BMC ITSM

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.

Excerpt language: en.

CVSS6.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:00 WIB

Official record

MedPublished 29 Oct 2026, 20:08 WIB

CVE-2026-119054

Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url

Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html_entity_decode() and …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.1v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:08 WIB

Official record

MedPublished 29 Oct 2026, 20:08 WIB

CVE-2026-119053

lwIP 2.0.0 through 2.2.1 SNMP Agent Out-of-Bounds Read via snmp_pbuf_stream_writeto()

lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds copies by pbuf->len instead of remaining bytes. Remote unauthenticated attackers knowing the read community can send fragmented SNMP requests to receive adjacent receive-buffer or po…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:01 WIB

Official record

HighPublished 29 Oct 2026, 20:08 WIB

CVE-2026-119052

llama.cpp b2877 before b11935 ggml-rpc Server DoS via Oversized recv_msg Length

llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR with a length above std::vector::max_siz…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:08 WIB

Official record

HighPublished 29 Oct 2026, 20:08 WIB

CVE-2026-119051

flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the Node.js event loop.

Excerpt language: en.

CVSS8.2v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:08 WIB

Official record

CritPublished 29 Oct 2026, 20:08 WIB

CVE-2026-119050

Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection

Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to make the agent call pandas.read_pickle on attacker-controlled paths for code executio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.2v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:08 WIB

Official record

HighPublished 29 Oct 2026, 20:08 WIB

CVE-2026-119049

FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming

FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding,…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7.2v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 21:02 WIB

Official record

LowPublished 29 Oct 2026, 20:08 WIB

CVE-2026-119048

JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module

JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that allows authenticated users to access other users' conversations due to missing and reversed ownership checks. Attackers who know or derive a victim's conversation id can call /a/cms/chat/message, /a/c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2.3v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:08 WIB

Official record

HighPublished 29 Oct 2026, 20:08 WIB

CVE-2019-25781

Python-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing

Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ or ![ characters, forcing LinkInlineProcessor.getText() and getLink() into quadrati…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS8.7v4.0KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:08 WIB

Official record

MedPublished 29 Oct 2026, 20:07 WIB

CVE-2026-42707

WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSUnavailableUpdated29 Oct 2026, 20:47 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage