Export limit exceeded: 421352 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421352 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421352 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107330 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-08 | 7.7 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability. | ||||
| CVE-2026-105473 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2026-11-08 | 4.6 Medium |
| IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Open Redirect. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this. | ||||
| CVE-2026-105467 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2026-11-08 | 8.1 High |
| IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this. | ||||
| CVE-2026-124432 | 1 Thorsten | 1 Phpmyfaq | 2026-11-08 | 7.3 High |
| phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs. | ||||
| CVE-2026-124491 | 1 Jihong88 | 1 Suneditor | 2026-11-08 | 6.4 Medium |
| SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft. | ||||
| CVE-2026-124444 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-08 | 7.1 High |
| OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such as Id_BitwiseAnd to read any database table, including other patients' records and staff password hashes. | ||||
| CVE-2026-103320 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-11-08 | 4.3 Medium |
| IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information. | ||||
| CVE-2026-102618 | 1 Ibm | 1 I | 2026-11-08 | 3.6 Low |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable. | ||||
| CVE-2026-101117 | 1 Ibm | 1 Websphere Extreme Scale | 2026-11-08 | 9.1 Critical |
| IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration. | ||||
| CVE-2025-36075 | 1 Ibm | 1 Safer Payments | 2026-11-08 | 5.3 Medium |
| IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information. | ||||
| CVE-2026-115718 | 1 Frappe | 1 Builder | 2026-11-08 | 4.3 Medium |
| Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and effectively turning the site into a free LLM proxy. | ||||
| CVE-2026-124425 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-08 | 3.1 Low |
| Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set. | ||||
| CVE-2026-124435 | 1 Openremote | 2 Core, Openremote | 2026-11-08 | 4.8 Medium |
| OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin. | ||||
| CVE-2026-124436 | 1 Openremote | 2 Core, Openremote | 2026-11-08 | 8 High |
| OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs. | ||||
| CVE-2026-61987 | 2026-11-08 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.8.1. | ||||
| CVE-2026-114186 | 2026-11-08 | 6.5 Medium | ||
| Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-114189 | 2026-11-08 | 8.5 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-109900 | 2026-11-08 | 9.6 Critical | ||
| Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: from n/a through 1.3.0. | ||||
| CVE-2026-120858 | 2026-11-08 | 6.5 Medium | ||
| Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.16. | ||||
| CVE-2026-109899 | 2026-11-08 | 7.1 High | ||
| Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0. | ||||