CVEs
Browse the synced catalog, newest first.
- CVE-2026-124457OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eranameopenemr
- CVE-2026-124456OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Moduleopenemr
- CVE-2026-124455OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignmentopenemr
- CVE-2026-124453OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.phpopenemr
- CVE-2026-124452OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notesopenemr
- CVE-2026-124451OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIRopenemr
- CVE-2026-124450OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocumentopenemr
- CVE-2026-124449OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routesopenemr
- CVE-2026-124448OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributesopenemr
- CVE-2026-124447OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpointopenemr
- CVE-2026-124446OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocumentopenemr
- CVE-2026-124445OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Forceopenemr
- CVE-2026-124444OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query APIopenemr
- CVE-2026-124443Frappe before 16.35.0 Broken Access Control in File List/Report Queriesfrappe
- CVE-2026-124442AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector RedirectsAzuraCast
- CVE-2026-124441Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target Kindkyverno
- CVE-2026-124440Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypasskyverno
- CVE-2026-124439Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowExceptionscriban
- CVE-2026-124438Scriban before 7.5.2 Delegate Target Exposure via array.map Member Accessscriban
- CVE-2026-124437Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursionscriban
- CVE-2026-124436OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resourcesopenremote core
- CVE-2026-124435OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Uploadopenremote core
- CVE-2026-124434Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actionsgetgrav grav
- CVE-2026-124433phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupControllerthorsten phpMyFAQ
- CVE-2026-124432phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-loginthorsten phpMyFAQ
- CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacementcraftcms cms
- CVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oraclecraftcms cms
- CVE-2026-124429Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registrationcraftcms cms
- CVE-2026-124428Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svgcraftcms cms
- CVE-2026-124427Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/nextcraftcms cms