Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 151–175 of 320
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-124440 | CRITICAL | Patched | 9.9 | 2026-11-08 | Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and c… |
| CVE-2026-124439 | HIGH | Patched | 7.5 | 2026-11-08 | Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison… |
| CVE-2026-124438 | CRITICAL | Patched | 7.4 | 2026-11-08 | Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values throu… |
| CVE-2026-124437 | HIGH | Patched | 7.5 | 2026-11-08 | Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.… |
| CVE-2026-124436 | HIGH | Patched | 8.0 | 2026-11-08 | OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints … |
| CVE-2026-124435 | MEDIUM | Patched | 4.8 | 2026-11-08 | OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files conta… |
| CVE-2026-124434 | HIGH | Patched | 7.1 | 2026-11-08 | Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media act… |
| CVE-2026-124433 | HIGH | Patched | 6.5 | 2026-11-08 | phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUP_DELETE permission to delete higher-privi… |
| CVE-2026-124432 | MEDIUM | Patched | 7.3 | 2026-11-08 | phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login… |
| CVE-2026-124431 | MEDIUM | Patched | 4.3 | 2026-11-08 | Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to browse volumes they lack permissions fo… |
| CVE-2026-124430 | HIGH | Patched | 8.8 | 2026-11-08 | Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator control panel users to obtain HMAC-signed Twig templates vi… |
| CVE-2026-124429 | HIGH | Patched | 7.5 | 2026-11-08 | Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public registrants to reclaim deactivated non-admin accounts wh… |
| CVE-2026-124428 | HIGH | Patched | 6.5 | 2026-11-08 | Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control panel users to read SVG files by posting arbitrary paths … |
| CVE-2026-124427 | CRITICAL | Patched | 9.8 | 2026-11-08 | Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next f… |
| CVE-2026-124426 | MEDIUM | Patched | 5.3 | 2026-11-08 | Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema'… |
| CVE-2026-124425 | LOW | Patched | 3.1 | 2026-11-08 | Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark field… |
| CVE-2026-124424 | HIGH | 7.1 | 2026-11-08 | WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid AI token to write arbitrary .vtt files by injecting … | |
| CVE-2026-124331 | MEDIUM | 7.3 | 2026-11-08 | A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulat… | |
| CVE-2026-124330 | LOW | 5.0 | 2026-11-08 | A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalF… | |
| CVE-2026-124329 | LOW | 5.0 | 2026-11-08 | A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/help… | |
| CVE-2026-124328 | LOW | 7.4 | 2026-11-08 | A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/… | |
| CVE-2026-124326 | LOW | 5.4 | 2026-11-08 | A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upl… | |
| CVE-2026-97195 | LOW | Patched | 3.5 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user … |
| CVE-2026-97194 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing us… |
| CVE-2026-97193 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationsh… |