CVE-2026-111896: phpMyFAQ from 4.2.0-alpha
- Severity
- 5.1 (MEDIUM)
- Vendor
- PHPMYFAQ FROM
- Affected versions
- Before 4.2.0-beta
- Fixed version
- 4.2.0-beta
- Patch status
- Patched
- Published
- 2026-10-17T19:16:31.337
Why it matters
This matters because the issue affects identity or token handling. Successful exploitation could allow unauthorized authentication, client manipulation, or access to protected services.
Recommended admin actions
- Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
- Compare installed versions against the affected version range in the advisory.
- Review logs for suspicious activity related to the affected application or component.
Technical summary
phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows FAQ editors to store executable SVG files. Attackers can split script tags around removed tokens like processing instructions so single-pass removal reassembles them, executing script in the application origin when victims open the file.
View the official NVD record for CVE-2026-111896
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
587 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-110372 |
OttoKit PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110886 |
Conversational Forms for ChatBot PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108983 |
GV-ASManager PATCH
Reporter: 0DF08A0E-A200-4957-9BB0-084F562506F9
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-109894 |
Booktics PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111998 |
vanus
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102503 |
cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) PATCH
Reporter: CVE-COORDINATION
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-103091 |
internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) PATCH
Reporter: CVE-COORDINATION
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112005 |
WhoDB 0.104.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-107436 |
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111999 |
Vanus 0.8.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112021 |
snac2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112001 |
ProjectSend 2.0.0 PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-110895 |
an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-112006 |
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-112051 |
Xinference
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-110373 |
Hamid Alinia Login with phone number login-with-phone-number
Reporter: AUDIT
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-111441 |
openGauss-server PATCH
Reporter: A1A479F7-907B-4AE8-A999-9148CADC9224
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-16487 |
REDHAT
Reporter: SECALERT
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-112015 |
Omnigent 0.3.0 PATCH
Reporter: DISCLOSURE
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-108120 |
SME Server
Reporter: VULNERABILITY
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-112082 |
SGLang
Reporter: CNA
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-112002 |
ProjectSend 2.5.0 PATCH
Reporter: DISCLOSURE
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-110383 |
Authorization Bypass
Reporter: AUDIT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-108984 |
GV-ASManager PATCH
Reporter: 0DF08A0E-A200-4957-9BB0-084F562506F9
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-16460 |
REDHAT
Reporter: SECALERT
|
7.4
HIGH
|
VIEW RECORD |
| CVE-2026-112018 |
cgltf
Reporter: DISCLOSURE
|
7.3
HIGH
|
VIEW RECORD |
| CVE-2026-112000 |
Vanus 0.8.0
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-76740 |
HPE
Reporter: SECURITY-ALERT
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-108485 |
ThemeGrill eStore estore
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-109895 |
Arraytics Booktics booktics
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-110382 |
NSquared Simply Schedule Appointments simply-schedule-appointments
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-110897 |
IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-112017 |
JeecgBoot PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111440 |
openGauss-connector-jdbc PATCH
Reporter: A1A479F7-907B-4AE8-A999-9148CADC9224
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-112007 |
Schism Tracker
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112008 |
libmng
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112016 |
Netcore NR256CN
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112019 |
cgltf
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112020 |
LodePNG
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112048 |
libspatialite
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112052 |
libspatialite
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112059 |
libLAS
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-108121 |
Brian Mariani from DigitalCanion SA
Reporter: VULNERABILITY
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112009 |
smpeg
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112010 |
smpeg
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112013 |
libtta
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112014 |
LobsterAI PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112046 |
OW2 ASM 9.11 PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112053 |
Schroedinger libschroedinger
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112054 |
Schroedinger libschroedinger
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112055 |
wvWare wv
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112056 |
wvWare wv
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112057 |
libdvdnav PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112058 |
VideoLAN libdvdnav
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-110024 |
@fastify/jwt is a JWT utility plugin for Fastify. In PATCH
Reporter: CE714D77-ADD3-4F53-AFF5-83D477B104BB
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-74921 |
The Document Gallery WordPress plugin
Reporter: CONTACT
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112049 |
Vita3K
Reporter: DISCLOSURE
|
6.7
MEDIUM
|
VIEW RECORD |
| CVE-2026-110365 |
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110880 |
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110883 |
VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110885 |
HivePress HivePress hivepress
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112077 |
radare2 PATCH
Reporter: CNA
|
6.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112060 |
librtmp in RTMPDump
Reporter: DISCLOSURE
|
6.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-112003 |
ProjectSend 2.0.0 PATCH
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112062 |
lwIP
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112063 |
libstrophe
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112011 |
libtta
Reporter: DISCLOSURE
|
5.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-111990 |
A weakness
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112025 |
A weakness
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112027 |
cms
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112028 |
A flaw
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112044 |
A security vulnerability
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112083 |
A security flaw
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112047 |
OneUptime 14.0.2 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112061 |
librtmp (RTMPDump)
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111988 |
A security flaw
Reporter: CNA
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112043 |
cal.com
Reporter: CNA
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-103311 |
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-106010 |
The BDM Digital Payment Gateway WordPress plugin
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-74922 |
The Document Gallery WordPress plugin
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-86791 |
The iPOSpays Payment Gateway for WooCommerce WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94228 |
The TrueBooker WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94229 |
The TrueBooker WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94230 |
The TrueBooker WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94231 |
The TrueBooker WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94272 |
The Snap Finance WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94294 |
The App Builder WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112111 |
The Bootstrap Shortcodes plugin for WordPress PATCH
Reporter: CVE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-112012 |
libtta
Reporter: DISCLOSURE
|
4.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-76739 |
HPE
Reporter: SECURITY-ALERT
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-91831 |
The Subscribe to Comments WordPress plugin PATCH
Reporter: CONTACT
|
3.8
LOW
|
VIEW RECORD |
| CVE-2026-110034 |
The Salon Booking System WordPress plugin PATCH
Reporter: CONTACT
|
3.7
LOW
|
VIEW RECORD |
| CVE-2026-112026 |
A security vulnerability
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112037 |
A flaw
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112041 |
diem
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112076 |
A security vulnerability
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112004 |
Teable PATCH
Reporter: DISCLOSURE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-112050 |
Gitify PATCH
Reporter: DISCLOSURE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-112112 |
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon
Reporter: CVE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-111984 |
stable-diffusion-webui
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.