Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 1–25 of 320
| CVE ID | Severity | Patch | CVSS ↓ | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-123551 | CRITICAL | Patched | 10.0 | 2026-11-08 | OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification We… |
| CVE-2026-107331 | CRITICAL | 9.9 | 2026-11-08 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. | |
| CVE-2026-124469 | CRITICAL | Patched | 9.9 | 2026-11-08 | OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] PO… |
| CVE-2026-124450 | CRITICAL | Patched | 9.9 | 2026-11-08 | OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. … |
| CVE-2026-124440 | CRITICAL | Patched | 9.9 | 2026-11-08 | Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and c… |
| CVE-2026-6715 | CRITICAL | 9.8 | 2026-11-08 | IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitizatio… | |
| CVE-2026-15266 | CRITICAL | 9.8 | 2026-11-08 | IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host. | |
| CVE-2026-124445 | CRITICAL | Patched | 9.8 | 2026-11-08 | OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed s… |
| CVE-2026-124427 | CRITICAL | Patched | 9.8 | 2026-11-08 | Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next f… |
| CVE-2026-110963 | CRITICAL | 9.8 | 2026-11-08 | The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that… | |
| CVE-2026-114432 | CRITICAL | Patched | 9.8 | 2026-11-08 | The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file clean… |
| CVE-2026-123614 | CRITICAL | Patched | 9.8 | 2026-11-08 | imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size valu… |
| CVE-2026-123549 | CRITICAL | Patched | 9.8 | 2026-11-08 | OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group… |
| CVE-2026-123550 | CRITICAL | Patched | 9.8 | 2026-11-08 | OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact … |
| CVE-2026-109900 | CRITICAL | 9.6 | 2026-11-08 | Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: … | |
| CVE-2026-114464 | CRITICAL | 9.3 | 2026-11-08 | IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control. | |
| CVE-2026-124493 | CRITICAL | Patched | — | 2026-11-08 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML esca… |
| CVE-2026-124494 | CRITICAL | Patched | — | 2026-11-08 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like &colon… |
| CVE-2026-17466 | CRITICAL | 9.1 | 2026-11-08 | IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal. | |
| CVE-2026-101117 | CRITICAL | 9.1 | 2026-11-08 | IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration. | |
| CVE-2026-124490 | CRITICAL | Patched | 9.1 | 2026-11-08 | OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers… |
| CVE-2026-9764 | HIGH | 8.8 | 2026-11-08 | IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code. | |
| CVE-2026-8639 | HIGH | 8.8 | 2026-11-08 | IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the vi… | |
| CVE-2026-117545 | HIGH | 8.8 | 2026-11-08 | IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. | |
| CVE-2026-110273 | HIGH | 8.8 | 2026-11-08 | IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of spe… |