CVE-2026-48195 is a stored cross-site scripting (XSS) vulnerability in the bPlugins PDF Poster plugin affecting versions before 2.6.2. It allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5. A fix is available in version 2.6.2.
Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to execute stored scripts in other users' browsers.
CVE-2026-39741 is a missing authorization vulnerability in the RelyWP Simple Cloudflare Turnstile plugin affecting versions before 1.44.1. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized actions. The issue has a medium severity with a CVSS score of 5.3. A fix is available in version 1.44.1.
CVE-2026-48196 is a stored cross-site scripting (XSS) vulnerability in Kali Forms (Kaliforms) affecting versions prior to 2.4.28. The flaw involves improper neutralization of input during web page generation, which can lead to injection of malicious scripts. This vulnerability has a CVSS score of 6.5, indicating a medium severity impact with potential for confidentiality, integrity, and availability loss. A fix is available in version 2.4.28.
CVE-2026-22386 is a missing authorization vulnerability in Ahmad WP Job Portal versions prior to 2.7.2. It allows exploitation due to incorrectly configured access control security levels. The issue affects all versions from initial release up to 2.7.1. A fix is available in version 2.7.2.
CVE-2026-52709 is a stored cross-site scripting (XSS) vulnerability in the bPlugins Video Gallery Block plugin affecting versions before 1.7.0. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of other users. This vulnerability has a CVSS score of 6.5, indicating a medium severity impact. The issue is fixed in version 1.7.0 of the plugin.
CVE-2026-113690 is a stored cross-site scripting (XSS) vulnerability in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users to upload script content that executes in other users' browsers. The vulnerability has a medium severity rating with a CVSS score of 4.8.
CVE-2026-113689 is a stored cross-site scripting (XSS) vulnerability in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. Authenticated users can inject malicious scripts that execute in other users' browsers when they view the affected notes. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.1.
CVE-2026-24533 is a stored cross-site scripting (XSS) vulnerability in CozyThemes Cozy Blocks cozy-addons. It affects Cozy Blocks versions from initial releases up to 2.2.27. The vulnerability allows improper neutralization of input during web page generation, which can lead to execution of malicious scripts. A fix is available in version 2.2.28.
CVE-2026-42703 is a missing authorization vulnerability in Kali Forms (Kaliforms) affecting versions from initial releases up to 2.4.27. This flaw allows exploitation due to incorrectly configured access control security levels, potentially enabling unauthorized access to sensitive data. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity) with network attack vector, low attack complexity, and requires low privileges without user interaction. A fix is available in version 2.4.28.
CVE-2026-113688 is a server-side request forgery (SSRF) vulnerability in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users to make server-side requests to internal services and observe the response information. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 5.3.
CVE-2026-118087 is a stored cross-site scripting (XSS) vulnerability in Gemini Labs Site Reviews affecting versions before 8.3.6. The flaw allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5. It is fixed in version 8.3.6.
CVE-2026-118094 is a stored cross-site scripting (XSS) vulnerability in the Igor Funa Ad Inserter plugin affecting versions before 2.8.19. This flaw involves improper neutralization of input during web page generation, which can lead to persistent injection of malicious scripts. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. It requires low privileges and user interaction but can impact confidentiality, integrity, and availability. A fix is available in version 2.8.19.
CVE-2026-39735 is a missing authorization vulnerability in Crocoblock JetEngine versions prior to 3.9.0.2. It allows exploitation due to incorrectly configured access control security levels, potentially leading to unauthorized data disclosure. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily affecting confidentiality. A fix is available in version 3.9.0.2.
CVE-2026-56056 is a stored cross-site scripting (XSS) vulnerability in The Post Grid plugin by Mamunur Rashid. It affects versions from initial releases up to 7.9.7. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts. The issue is fixed in version 7.9.8.
CVE-2026-118093 is a missing authorization vulnerability in the WPFunnels Team Product Feed Manager plugin for WooCommerce. The flaw allows unauthorized users to exploit incorrectly configured access control, potentially leading to unauthorized actions. This affects all versions from initial release up to 7.14.1. The issue has been fixed in version 7.14.2. The vulnerability has a medium severity rating with a CVSS score of 5.3 and does not impact confidentiality or availability but allows integrity impact without requiring privileges or user interaction.
A hacker leaked over 41,000 records of US Department of Homeland Security employees, allegedly stolen from an Okta single sign-on system. The leaked data includes personal and work information such as names, work emails, phone numbers, job titles, office locations, and access details to internal systems and applications. The breach affects employees from multiple DHS agencies, including Customs and Border Protection, Immigration and Customs Enforcement, Homeland Security Investigations, and CISA. The leak provides attackers with detailed access information, potentially enabling targeted attacks on critical personnel and systems.
A vulnerability in dnsmasq's TFTP server can cause it to serve incorrect file contents due to a stale transfer cache not being invalidated after a transfer completes. This flaw allows an attacker on the local network to cause a victim client to receive previously cached data instead of the requested file. In PXE network-boot environments, this can lead to attacker-chosen boot content being substituted for the victim machine's legitimate boot files.
CVE-2026-93007 is a moderate severity vulnerability in dnsmasq used by Red Hat Ceph Storage 9. The TCP DNS service uses a small fixed pool of child processes without a receive timeout on client connections. A remote attacker can exhaust this pool by opening idle TCP connections to port 53, disrupting TCP DNS operations such as DNSSEC validation that require TCP fallback. UDP DNS resolution remains functional, and the affected slots recover automatically after about 150 seconds unless the attacker reconnects. The impact is limited to TCP-dependent DNS functions, with availability impact rated as low.
CVE-2026-93011 is a medium severity vulnerability in dnsmasq used by Red Hat Ceph Storage 9. It involves an out-of-bounds write of 1-3 bytes past a name buffer during DNSSEC validation when converting names to and from DNS wire format. This flaw can overwrite adjacent heap metadata but has no demonstrated crash or control-flow impact. DNSSEC support is disabled by default and must be explicitly enabled both at compile time and runtime. The vulnerability is a follow-on issue related to a previous buffer size reduction and affects dnsmasq versions prior to 2.93.