CVE-2026-88743

MediumCVSS 6.1/10Last modified Sep 22, 2026

Description

Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 22, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-887456.1EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.CVE-2026-887467.1idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.CVE-2026-88756.4The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' (and 'c') shortcCVE-2026-887537.5A Regular-Expression Denial of Service (ReDoS) in the Markdown2. extract_metadata() function (lib/markdown2.py) of trentm markdown2 through CVE-2026-887557.8Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace confCVE-2026-887565.3Pagekit CMS <= 1.0.18 allows an unauthenticated attacker to perform SQL injection through the credentials array submitted to the public logiCVE-2026-88767.3Version 3.0.7 of the Securly Chrome Extension contains hardcoded, plaintext AES passphrases in securly.min.js. These keys decrypt crisis aleCVE-2026-887615.3The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are adverCVE-2026-887635.9A flaw was found in the skupper-router component of Red Hat Service Interconnect, which is used to provide secure communication between distCVE-2026-887645.4The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification maCVE-2026-887658.5GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under cerCVE-2026-88776.4The Responsive Video Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rem_video' shortcode in versions up
CVE-2026-88743: Medium severity, CVSS 6.1 | Vulnix