Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 1–25 of 320
| CVE ID | Severity ↑ | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-124498 | LOW | 3.5 | 2026-11-08 | A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacted element is an unknown function of the file /jsp/ge/dummy_launche… | |
| CVE-2026-8640 | LOW | 3.5 | 2026-11-08 | IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 does not set the SameSite attribute on session cookies, making it vulnerable to Cross-Si… | |
| CVE-2026-84228 | LOW | 3.1 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. | |
| CVE-2026-84237 | LOW | 3.1 | 2026-11-08 | IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | |
| CVE-2026-18194 | LOW | 2.5 | 2026-11-08 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to perform unauthorized actions due to missing anti-clickjacking controls. | |
| CVE-2026-102618 | LOW | 3.6 | 2026-11-08 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable. | |
| CVE-2025-0166 | LOW | 2.7 | 2026-11-08 | IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be ac… | |
| CVE-2026-124425 | LOW | Patched | 3.1 | 2026-11-08 | Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark field… |
| CVE-2026-124330 | LOW | 5.0 | 2026-11-08 | A vulnerability was determined in FlowCI flow-core-x up to 1.23.49. This affects the function exist/save/read/remove of the file store/src/main/java/com/flowci/store/LocalF… | |
| CVE-2026-124329 | LOW | 5.0 | 2026-11-08 | A vulnerability was found in FlowCI flow-core-x up to 1.23.49. The impacted element is the function FileHelper.unzip of the file common/src/main/java/com/flowci/common/help… | |
| CVE-2026-124328 | LOW | 7.4 | 2026-11-08 | A vulnerability has been found in FlowCI flow-core-x up to 1.23.49. The affected element is the function ConditionManagerImpl.run of the file core/src/main/java/com/flowci/… | |
| CVE-2026-124326 | LOW | 5.4 | 2026-11-08 | A flaw has been found in DataLinkDC Dinky up to 1.2.5. Impacted is the function file.getOriginalFilename of the file CatalogueController.java of the component Catalogue Upl… | |
| CVE-2026-97192 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting values submitted through the post editor save path, … |
| CVE-2026-97193 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object before writing to it during bidirectional relationsh… |
| CVE-2026-97194 | LOW | Patched | 2.7 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing us… |
| CVE-2026-97195 | LOW | Patched | 3.5 | 2026-11-08 | The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting part of it as an HTML attribute name, allowing a user … |
| CVE-2026-96963 | LOW | 2.7 | 2026-11-08 | The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions, allowing users with a role as low as contributor to … | |
| CVE-2026-104338 | LOW | Patched | 3.7 | 2026-11-08 | The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not perform an authorization check on one of its REST routes and derives the acting user's identity from an … |
| CVE-2026-123568 | LOW | Patched | 4.4 | 2026-11-08 | Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the … |
| CVE-2026-123548 | LOW | Patched | 4.7 | 2026-11-08 | OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and name-identifier management, SAML v2.0 identity provid… |
| CVE-2026-123547 | LOW | Patched | 4.7 | 2026-11-08 | OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites because RelayState is unchecked when no relayStateUrl… |
| CVE-2026-123540 | LOW | Patched | 2.0 | 2026-11-08 | OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content … |
| CVE-2026-123535 | LOW | Patched | 4.2 | 2026-11-08 | Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing inj… |
| CVE-2026-123508 | LOW | Patched | 3.1 | 2026-11-08 | Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers wh… |
| CVE-2026-123510 | LOW | Patched | 3.3 | 2026-11-08 | Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. L… |