Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 1–25 of 320
| CVE ID ↑ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2024-41786 | MEDIUM | 5.3 | 2026-11-08 | IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due t… | |
| CVE-2025-0166 | LOW | 2.7 | 2026-11-08 | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be ac… | |
| CVE-2025-1837 | MEDIUM | 5.4 | 2026-11-08 | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due … | |
| CVE-2025-36075 | MEDIUM | 5.3 | 2026-11-08 | IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated use… | |
| CVE-2026-101117 | CRITICAL | 9.1 | 2026-11-08 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration. | |
| CVE-2026-102618 | LOW | 3.6 | 2026-11-08 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable. | |
| CVE-2026-103303 | HIGH | 8.8 | 2026-11-08 | The Turisbook Booking System WordPress plugin through 1.3.8 does not have authorisation and CSRF checks when saving its settings, and does not sanitise and escape one of th… | |
| CVE-2026-103320 | MEDIUM | 4.3 | 2026-11-08 | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information. | |
| CVE-2026-103375 | MEDIUM | 5.3 | 2026-11-08 | The Antom Payments WordPress plugin through 2.0.11 does not perform any ownership or authorisation check before returning an order's confirmation link, which contains its s… | |
| CVE-2026-104307 | MEDIUM | Patched | 5.4 | 2026-11-08 | The BackUpWordPress plugin before 3.15 does not perform a capability or nonce check on an AJAX action that cleans up its backup directory, allowing any authenticated user (… |
| CVE-2026-104337 | MEDIUM | Patched | 5.3 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing un… |
| CVE-2026-104338 | LOW | Patched | 3.7 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an … |
| CVE-2026-104639 | MEDIUM | Patched | 4.1 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not sanitize and escape a value derived from an incoming webhook request before using it in a SQL query, all… |
| CVE-2026-105467 | HIGH | 8.1 | 2026-11-08 | IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL whil… | |
| CVE-2026-105473 | MEDIUM | 4.6 | 2026-11-08 | IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Open Redirect. A victim must open a specifically crafted URL whil… | |
| CVE-2026-105970 | MEDIUM | 5.3 | 2026-11-08 | The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a defaul… | |
| CVE-2026-106015 | HIGH | 8.1 | 2026-11-08 | The Ecommerce Affiliate WordPress plugin through 1.0.0 does not restrict one-time password issuance and verification to the legitimate account owner, nor limit verification… | |
| CVE-2026-107330 | HIGH | 7.7 | 2026-11-08 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability. | |
| CVE-2026-107331 | CRITICAL | 9.9 | 2026-11-08 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. | |
| CVE-2026-108284 | MEDIUM | 6.5 | 2026-11-08 | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information. | |
| CVE-2026-108292 | MEDIUM | 5.5 | 2026-11-08 | IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened. | |
| CVE-2026-10844 | MEDIUM | 4.3 | 2026-11-08 | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks. | |
| CVE-2026-109899 | HIGH | 7.1 | 2026-11-08 | Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This is… | |
| CVE-2026-109900 | CRITICAL | 9.6 | 2026-11-08 | Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: … | |
| CVE-2026-109925 | HIGH | Patched | 8.6 | 2026-11-08 | The Productive Commerce WordPress plugin before 1.1.54 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to p… |