Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 1–25 of 320
| CVE ID | Severity | Patch | CVSS ↑ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-123540 | LOW | Patched | 2.0 | 2026-11-08 | OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content … |
| CVE-2026-123612 | MEDIUM | 2.3 | 2026-11-08 | rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before the handshake completes to the client-facing server w… | |
| CVE-2026-18194 | LOW | 2.5 | 2026-11-08 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls. | |
| CVE-2025-0166 | LOW | 2.7 | 2026-11-08 | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be ac… | |
| CVE-2026-97192 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, … |
| CVE-2026-97193 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationsh… |
| CVE-2026-97194 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing us… |
| CVE-2026-96963 | LOW | 2.7 | 2026-11-08 | The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to … | |
| CVE-2026-123507 | MEDIUM | Patched | 2.7 | 2026-11-08 | Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configura… |
| CVE-2026-84228 | LOW | 3.1 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. | |
| CVE-2026-84237 | LOW | 3.1 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | |
| CVE-2026-124425 | LOW | Patched | 3.1 | 2026-11-08 | Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark field… |
| CVE-2026-123508 | LOW | Patched | 3.1 | 2026-11-08 | Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers wh… |
| CVE-2026-123510 | LOW | Patched | 3.3 | 2026-11-08 | Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. L… |
| CVE-2026-123496 | MEDIUM | Patched | 3.3 | 2026-11-08 | Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks.… |
| CVE-2026-124498 | LOW | 3.5 | 2026-11-08 | A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacted element is an unknown function of the file /jsp/ge/dummy_launche… | |
| CVE-2026-8640 | LOW | 3.5 | 2026-11-08 | IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Si… | |
| CVE-2026-97195 | LOW | Patched | 3.5 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user … |
| CVE-2026-123494 | MEDIUM | Patched | 3.5 | 2026-11-08 | Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft T… |
| CVE-2026-102618 | LOW | 3.6 | 2026-11-08 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable. | |
| CVE-2026-104338 | LOW | Patched | 3.7 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an … |
| CVE-2026-123610 | MEDIUM | Patched | 3.7 | 2026-11-08 | rustls before 0.23.46 contains an uncontrolled memory allocation flaw in its optional Brotli certificate decompression, which limits decompressed output size but accepts an… |
| CVE-2026-123611 | MEDIUM | Patched | 3.7 | 2026-11-08 | rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the per-server-name key-exchange group record via an unauthent… |
| CVE-2026-123597 | MEDIUM | Patched | 3.7 | 2026-11-08 | Hickory DNS hickory-proto 0.25.0-alpha.1 through 0.26.0-alpha.1 and hickory-net before 0.26.2 contain a logic bug in DnssecDnsHandle's DS-fetch path that caches transient D… |
| CVE-2026-123598 | MEDIUM | Patched | 3.7 | 2026-11-08 | The validating recursor in Hickory DNS hickory-recursor 0.25.0 through 0.26.0-alpha.1, hickory-resolver 0.26.0-alpha.1 before 0.26.2, and hickory-net 0.26.0-beta.1 before 0… |