Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 76–100 of 320
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-108284 | MEDIUM | 6.5 | 2026-11-08 | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information. | |
| CVE-2026-107331 | CRITICAL | 9.9 | 2026-11-08 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. | |
| CVE-2026-107330 | HIGH | 7.7 | 2026-11-08 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability. | |
| CVE-2026-105473 | MEDIUM | 4.6 | 2026-11-08 | IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Open Redirect. A victim must open a specifically crafted URL whil… | |
| CVE-2026-105467 | HIGH | 8.1 | 2026-11-08 | IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL whil… | |
| CVE-2026-61987 | MEDIUM | 6.5 | 2026-11-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager … | |
| CVE-2026-120858 | MEDIUM | 6.5 | 2026-11-08 | Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F… | |
| CVE-2026-114189 | HIGH | 8.5 | 2026-11-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injecti… | |
| CVE-2026-114188 | MEDIUM | 6.5 | 2026-11-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This i… | |
| CVE-2026-114186 | MEDIUM | 6.5 | 2026-11-08 | Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… | |
| CVE-2026-109900 | CRITICAL | 9.6 | 2026-11-08 | Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: … | |
| CVE-2026-109899 | HIGH | 7.1 | 2026-11-08 | Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This is… | |
| CVE-2026-103320 | MEDIUM | 4.3 | 2026-11-08 | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information. | |
| CVE-2026-102618 | LOW | 3.6 | 2026-11-08 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable. | |
| CVE-2026-101117 | CRITICAL | 9.1 | 2026-11-08 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration. | |
| CVE-2025-36075 | MEDIUM | 5.3 | 2026-11-08 | IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated use… | |
| CVE-2025-1837 | MEDIUM | 5.4 | 2026-11-08 | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due … | |
| CVE-2025-0166 | LOW | 2.7 | 2026-11-08 | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be ac… | |
| CVE-2024-41786 | MEDIUM | 5.3 | 2026-11-08 | IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due t… | |
| CVE-2026-124553 | HIGH | Patched | 7.5 | 2026-11-08 | BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cid… |
| CVE-2026-124552 | MEDIUM | 4.8 | 2026-11-08 | Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines un… | |
| CVE-2026-124551 | MEDIUM | 5.3 | 2026-11-08 | ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /c… | |
| CVE-2026-124494 | CRITICAL | Patched | — | 2026-11-08 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like &colon… |
| CVE-2026-124493 | CRITICAL | Patched | — | 2026-11-08 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML esca… |
| CVE-2026-124492 | HIGH | Patched | 7.6 | 2026-11-08 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textConten… |