Tagged “cve.org”
CVEs tagged cve.org, newest first.
47215 CVEsRSS
CVE-2026-113692Medium· 6.9Path Traversal in BMC ITSM
Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
CVE-2026-118425Medium· 6.8Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via D…
CVE-2026-113694Medium· 5.3Improper Authorization in BMC ITSM SmartIT Attachments
Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to access or modify attachment resources belonging to other users.
CVE-2026-113695Medium· 4.8Reflected Cross-Site Scripting in BMC ITSM SmartIT
Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to inject script content into HTML responses viewed by ano…
CVE-2026-113697Medium· 4.8Reflected Cross-Site Scripting in BMC Helix Operations Management
Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execute script in another user's browser after that user opens a crafted link.
CVE-2026-113696Medium· 5.3Improper Authorization in BMC ITSM SmartIT Change Approvals
Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make unauthorized changes to approval state and bypass intended approva…
CVE-2026-118093Medium· 5.3WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPFunnels Team Product Feed Manager best-woocommerce-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed Manager: from n/a through 7.14.1.
CVE-2026-39735Medium· 6.5WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetEngine: from n/a through 3.9.0.1.
CVE-2026-42703Medium· 6.5WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability
Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.
CVE-2026-118087Medium· 6.5WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.
CVE-2026-52709Medium· 6.5WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.
CVE-2026-24533Medium· 6.5WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.
CVE-2026-118094Medium· 6.5WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.
CVE-2026-56056Medium· 6.5WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.
CVE-2026-22386Medium· 4.3WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.1.
CVE-2026-48196Medium· 6.5WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.
CVE-2026-48195Medium· 6.5WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.
CVE-2026-42707Medium· 4.3WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through 1.1.4.
CVE-2026-39741Medium· 5.3WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Cloudflare Turnstile: from n/a throug…
CVE-2026-54862Medium· 6.5WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export …
CVE-2026-119054Medium· 5.4Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the [mpg] and [mpg_match] shortcode base-url attribute. Attackers can store …
CVE-2026-119050High· 8.1PoCAgno through 3.1.11 Code Execution via PandasTools Unsafe Reflection
Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by supplying model-controlled function names to getattr(). Attackers can use prompt injection to ma…
CVE-2026-119051Medium· 5.9PoCflat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys
flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing…
CVE-2019-25781High· 7.5PoCPython-Markdown 3.0 through 3.11.2 Denial of Service via Link Bracket Parsing
Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to exhaust CPU through unmatched brackets. Attackers can submit short Markdown containing repeated [ …
CVE-2026-40063Medium· 5.3A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809)
A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attacker can make an unauthenticated HTTP req…
CVE-2026-71569Medium· 4.8PoCApache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name
Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component. This issue affects Apache Camel: from 4.21.0 before 4.22.2. WebhookUrlValidator classified a push notification webhook host in two places that did not …
CVE-2026-5698Medium· 4.8Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters an…
CVE-2026-42922Critical· 9.8A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809)
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to …
CVE-2026-5697Medium· 4.8Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters an…
CVE-2026-5702Medium· 4.8Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.