Search
128 CVEs · published 2026-11-08 to 2026-11-08, High severity
CVEs (128)
Showing 1–25 of 128
| CVE ID | Severity | Patch | CVSS | Published ↓ | Description |
|---|---|---|---|---|---|
| CVE-2026-96146 | HIGH | 7.5 | 2026-11-08 | IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | |
| CVE-2026-118904 | HIGH | 8.1 | 2026-11-08 | IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. | |
| CVE-2026-9764 | HIGH | 8.8 | 2026-11-08 | IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code. | |
| CVE-2026-97677 | HIGH | 8.1 | 2026-11-08 | IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassin… | |
| CVE-2026-93879 | HIGH | 7.5 | 2026-11-08 | Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled … | |
| CVE-2026-8639 | HIGH | 8.8 | 2026-11-08 | IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the vi… | |
| CVE-2026-19133 | HIGH | 8.1 | 2026-11-08 | IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization. | |
| CVE-2026-18893 | HIGH | 7.1 | 2026-11-08 | IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function. | |
| CVE-2026-18093 | HIGH | 7.5 | 2026-11-08 | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control. | |
| CVE-2026-117545 | HIGH | 8.8 | 2026-11-08 | IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. | |
| CVE-2026-116501 | HIGH | 8.4 | 2026-11-08 | IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a… | |
| CVE-2026-116499 | HIGH | 8.4 | 2026-11-08 | IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data. | |
| CVE-2026-110273 | HIGH | 8.8 | 2026-11-08 | IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of spe… | |
| CVE-2026-107330 | HIGH | 7.7 | 2026-11-08 | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability. | |
| CVE-2026-105467 | HIGH | 8.1 | 2026-11-08 | IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL whil… | |
| CVE-2026-114189 | HIGH | 8.5 | 2026-11-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injecti… | |
| CVE-2026-109899 | HIGH | 7.1 | 2026-11-08 | Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This is… | |
| CVE-2026-124553 | HIGH | Patched | 7.5 | 2026-11-08 | BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cid… |
| CVE-2026-124492 | HIGH | Patched | 7.6 | 2026-11-08 | SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textConten… |
| CVE-2026-124489 | HIGH | Patched | 7.1 | 2026-11-08 | OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks … |
| CVE-2026-124488 | HIGH | Patched | 8.1 | 2026-11-08 | OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bo… |
| CVE-2026-124487 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to gene… |
| CVE-2026-124486 | HIGH | Patched | 8.8 | 2026-11-08 | OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other p… |
| CVE-2026-124485 | HIGH | Patched | 6.5 | 2026-11-08 | OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' doc… |
| CVE-2026-124484 | HIGH | Patched | 8.8 | 2026-11-08 | OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents… |