Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 1–25 of 320
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97677 | HIGH | 8.1 | 2026-11-08 | IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassin… | |
| CVE-2026-9764 | HIGH | 8.8 | 2026-11-08 | IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code. | |
| CVE-2026-97195 | LOW | Patched | 3.5 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user … |
| CVE-2026-97194 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing us… |
| CVE-2026-97193 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationsh… |
| CVE-2026-97192 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, … |
| CVE-2026-96963 | LOW | 2.7 | 2026-11-08 | The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to … | |
| CVE-2026-96961 | MEDIUM | 6.5 | 2026-11-08 | The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on one of its request handlers, allowing unauthenticated … | |
| CVE-2026-96146 | HIGH | 7.5 | 2026-11-08 | IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | |
| CVE-2026-95867 | MEDIUM | 6.7 | 2026-11-08 | IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a local attacker to execute arbitrary code due to a buffer overflow. | |
| CVE-2026-93879 | HIGH | 7.5 | 2026-11-08 | Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled … | |
| CVE-2026-93005 | MEDIUM | 6.5 | 2026-11-08 | IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated attacker to cause a denial of service through insufficient rate limiting of email notifications, resulti… | |
| CVE-2026-8860 | MEDIUM | 6.5 | 2026-11-08 | IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 accepts GET requests for authentication, allowing credentials to be passed as URL parame… | |
| CVE-2026-8642 | MEDIUM | 4.3 | 2026-11-08 | IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and s… | |
| CVE-2026-8640 | LOW | 3.5 | 2026-11-08 | IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Si… | |
| CVE-2026-8639 | HIGH | 8.8 | 2026-11-08 | IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the vi… | |
| CVE-2026-85344 | MEDIUM | Patched | 4.3 | 2026-11-08 | The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX action that carries out a site-wide content rewrite, … |
| CVE-2026-84237 | LOW | 3.1 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | |
| CVE-2026-84229 | MEDIUM | 6.5 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote attacker to bypass security restrictions due to improper validation of CSRF tokens for GET requests. | |
| CVE-2026-84228 | LOW | 3.1 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. | |
| CVE-2026-84030 | MEDIUM | 5.6 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. | |
| CVE-2026-82830 | MEDIUM | 6.7 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of argument delimiters. | |
| CVE-2026-81542 | MEDIUM | 6.4 | 2026-11-08 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal. | |
| CVE-2026-81209 | MEDIUM | 4.9 | 2026-11-08 | IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1, 6.2.2.0 - 6.2.2.1_1 Standard Edition cou… | |
| CVE-2026-80435 | MEDIUM | 5.0 | 2026-11-08 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity (XXE) injection flaw. |