CVEs published November 8, 2026
323 CVEs were published on November 8, 2026: 23 critical, 128 high. 1 early warning was posted.
- Published
- 323
- Critical
- 23
- High
- 128
- Medium
- 149
- Low
- 23
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 297
- Early warnings
- 1
Most affected products
- openemr
- 44
- go-vikunja vikunja
- 39
- hickory-dns
- 37
- OpenIdentityPlatform OpenAM
- 18
- sveltejs devalue
- 8
- IBM DataStage on Cloud Pak for Data
- 7
- ZcashFoundation zebra
- 7
- craftcms cms
- 6
- IBM App Connect Enterprise
- 5
- IBM Guardium Data Protection
- 5
Early warnings 1
Critical 23
- CVE-2026-6715Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-17466IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilitiesIBM Optim
- CVE-2026-15266Multiple Vulnerabilities in IBM Concert SoftwareIBM Concert
- CVE-2026-114464Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026IBM Process Mining
- CVE-2026-107331DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-101117IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.IBM WebSphere Extreme Scale
- CVE-2026-109900WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerabilityMelapress Role Editor
- CVE-2026-124494SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer BypassJiHong88 suneditor
- CVE-2026-124493SunEditor before 3.4.0 Stored XSS via DocumentType Header textContentJiHong88 suneditor
- CVE-2026-124490OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocumentopenemr
- CVE-2026-124469OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameteropenemr
- CVE-2026-124463OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print Viewopenemr
- CVE-2026-124450OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocumentopenemr
- CVE-2026-124445OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Forceopenemr
- CVE-2026-124440Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypasskyverno
- CVE-2026-124438Scriban before 7.5.2 Delegate Target Exposure via array.map Member Accessscriban
- CVE-2026-124427Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/nextcraftcms cms
- CVE-2026-110963Userplace <= 1.2.0 - Unauthenticated Privilege EscalationUserplace
- CVE-2026-114432Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 FilenameContact Form
- CVE-2026-123614imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflowimgproxy · github.com/imgproxy/imgproxy/v3 +2
- CVE-2026-123551OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocketOpenIdentityPlatform OpenAM
- CVE-2026-123550OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned AssertionsOpenIdentityPlatform OpenAM
- CVE-2026-123549OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute BypassOpenIdentityPlatform OpenAM
High 128
- CVE-2026-118904IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication.IBM webMethods Integration Server
- CVE-2026-96146Multiple vulnerabilities previously addressed in IBM SevOne Network Performance ManagementIBM SevOne Network Performance Management
- CVE-2026-97677Langflow OSS is affected by multiple vulnerabilitiesIBM Langflow OSS
- CVE-2026-9764IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server executionIBM Bob Shell
- CVE-2026-93879Hibernate Validator is affected by an expression language injection vulnerabilityIBM Hibernate Validator
- CVE-2026-8639IBM Verify Directory is affected by multiple vulnerabilitiesIBM Security Verify Directory · IBM Verify Directory
- CVE-2026-19133TS4500 Tape Library addresses security vulnerabilityIBM Storage TS4500 Library
- CVE-2026-18893CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilitiesCockroachDB PostgreSQL for IBM VPC
- CVE-2026-18093IBM App Connect Enterprise is vulnerable to a credential exposureIBM App Connect Enterprise
- CVE-2026-117545IBM webMethods Integration Server is vulnerable of bypassing the two-factor authentication mechanism.IBM webMethods Integration Server
- CVE-2026-116501Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary().IBM Qiskit SDK
- CVE-2026-116499Arbitrary Code Execution in Qiskit SDK QPY DeserializationIBM Qiskit SDK
- CVE-2026-110273Security Vulnerability identified in IBM TRIRIGA - Command ExecutionIBM TRIRIGA Application Platform
- CVE-2026-107330DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-105467IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSSIBM QRadar
- CVE-2026-114189WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerabilityWPVibes AnyWhere Elementor
- CVE-2026-109899WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerabilityMelapress Role Editor
- CVE-2026-124553BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsingfunstory-ai BabelDOC
- CVE-2026-124465Trendyol kafka-konsumer 2.3.3 before 2.6.18 Denial of Service via Batch Consumer PanicTrendyol kafka-konsumer
- CVE-2026-124492SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark ListJiHong88 suneditor
- CVE-2026-124489OpenEMR before 8.3.0 Broken Access Control via portal_payment.phpopenemr
- CVE-2026-124488OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encountersopenemr
- CVE-2026-124487OpenEMR before 8.4.0 Improper Authorization in FHIR DocumentReference $docrefopenemr
- CVE-2026-124486OpenEMR before 8.3.0 Missing Authorization in Classic Document Controlleropenemr
- CVE-2026-124485OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents APIopenemr
Show all 128 entriesShow fewer entries
- CVE-2026-124484OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIsopenemr
- CVE-2026-124483OpenEMR before 8.4.0 Improper Authorization via Prescription REST APIopenemr
- CVE-2026-124482OpenEMR before 8.4.0 Cross-Patient PHI Exfiltration via SMART Patient Launchopenemr
- CVE-2026-124481OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Paymentsopenemr
- CVE-2026-124480OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKENopenemr
- CVE-2026-124479OpenEMR before 8.4.0 Arbitrary File Read via REST Document Downloadopenemr
- CVE-2026-124478OpenEMR before 8.3.0 Missing Authorization via addRecall in save.phpopenemr
- CVE-2026-124477OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.phpopenemr
- CVE-2026-124476OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.phpopenemr
- CVE-2026-124475OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patientopenemr
- CVE-2026-124473OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update APIopenemr
- CVE-2026-124472OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.phpopenemr
- CVE-2026-124471OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.phpopenemr
- CVE-2026-124470OpenEMR before 8.3.0 BOLA via portal_custom_report.php Exposes Patient Problem Listsopenemr
- CVE-2026-124468OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST APIopenemr
- CVE-2026-124467OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax uploadopenemr
- CVE-2026-124464OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via QuestionnaireResponseopenemr
- CVE-2026-124462OpenEMR before 8.3.0 Patient Portal IDOR via Case-Sensitive Pid Parameteropenemr
- CVE-2026-124461OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpointopenemr
- CVE-2026-124460OpenEMR before 8.3.0 IDOR in Patient Portal PortalPatientControlleropenemr
- CVE-2026-124459OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlersopenemr
- CVE-2026-124458OpenEMR before 8.4.0 FHIR Patient Compartment Bypass via Person Endpointopenemr
- CVE-2026-124457OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eranameopenemr
- CVE-2026-124456OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Moduleopenemr
- CVE-2026-124455OpenEMR before 8.3.0 IDOR via Portal OnsiteDocument Pid_Equals Mass-Assignmentopenemr
- CVE-2026-124453OpenEMR before 8.3.0 IDOR in Portal Patient Settings via persist.phpopenemr
- CVE-2026-124449OpenEMR before 8.4.0 Missing Authorization via FHIR Media and QuestionnaireResponse Routesopenemr
- CVE-2026-124448OpenEMR before 8.3.0 Stored XSS via CCDA/CCD Preview XSLT Attributesopenemr
- CVE-2026-124447OpenEMR before 8.3.0 IDOR via OnsitePortalActivityController Update Endpointopenemr
- CVE-2026-124446OpenEMR before 8.3.0 Arbitrary File Read and Write via FaxSMS disposeDocumentopenemr
- CVE-2026-124444OpenEMR before 8.4.0 SQL Injection via OnsiteDocument Query APIopenemr
- CVE-2026-124442AzuraCast before 0.24.0 SSRF Filter Bypass via Webhook Connector RedirectsAzuraCast
- CVE-2026-124441Kyverno before 1.19.2 Authorization Bypass via Variable Generate Target Kindkyverno
- CVE-2026-124439Scriban before 7.5.3 Denial of Service via Uncatchable StackOverflowExceptionscriban
- CVE-2026-124437Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursionscriban
- CVE-2026-124436OpenRemote before 1.32.2 Improper Authorization Allows Realm Admins to Modify Global Resourcesopenremote core
- CVE-2026-124434Grav Lightbox Gallery 1.1.0 before 1.3.2 File Read via Shortcode Media Actionsgetgrav grav
- CVE-2026-124433phpMyFAQ before 4.1.11 Insufficient Authorization in Group Deletion via GroupControllerthorsten phpMyFAQ
- CVE-2026-124430Craft CMS 5.10.0 before 5.11.2 RCE via app/render-elements Signing Oraclecraftcms cms
- CVE-2026-124429Craft CMS 5.0.0 before 5.11.2 Privilege Escalation via Public Registrationcraftcms cms
- CVE-2026-124428Craft CMS 5.7.0 before 5.11.2 Arbitrary SVG File Read via app/icon-svgcraftcms cms
- CVE-2026-124424WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.phpWWBN AVideo
- CVE-2026-109925Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare HandlersProductive Commerce
- CVE-2026-106015Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute ForceEcommerce Affiliate
- CVE-2026-103303Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background SettingTurisbook Booking System
- CVE-2026-114713The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies…UnrealIRCd
- CVE-2026-123616imgproxy 3.3.0 before 4.0.16 Memory Exhaustion DoS via ICO Loaderimgproxy · github.com/imgproxy/imgproxy +3
- CVE-2026-123615imgproxy before 4.0.17 Out-of-Bounds Write in ICO Loaderimgproxy · github.com/imgproxy/imgproxy +3
- CVE-2026-123608Hickory DNS hickory-proto 0.3.1 before 0.26.1 CPU Exhaustion via BinEncoder Name Compressionhickory-dns · hickory-proto
- CVE-2026-123607Hickory DNS NSEC3 Closest-Encloser Proof Unbounded Loop Denial of Servicehickory-dns · hickory-net
- CVE-2026-123606Hickory-DNS Recursor 0.25.0-alpha.3 through 0.25.2 Glueless-NS Referral Amplificationhickory-dns
- CVE-2026-123605Hickory DNS through 0.25.0-alpha.3 DNSSEC Validation Bypass via RRSIG Signer's Namehickory-dns
- CVE-2026-123604Hickory DNS 0.26.0-beta.1 before 0.26.2 Resource Exhaustion DoS via NameServerPool::try_send TC-Retry Loophickory-dns
- CVE-2026-123602Hickory DNS Recursor Ghost Domain Attack via Child-Side NS RRset Cachinghickory-dns
- CVE-2026-123601Hickory DNS 0.26.0-beta.1 before 0.26.2 NSEC3 Proof of Nonexistence Forgeryhickory-dns
- CVE-2026-123596Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEChickory-dns
- CVE-2026-123595Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Ancestor-Delegation NSEC3hickory-dns
- CVE-2026-123592Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Name Hash Collisionhickory-dns
- CVE-2026-123591Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Missing RFC 6840 Checkshickory-dns
- CVE-2026-123588Hickory DNS Recursive Resolver Denial of Service via Cached Empty Connection Poolhickory-dns
- CVE-2026-123587Hickory-DNS 0.26.0 before 0.26.2 DNSSEC Nonexistence Forgery via Wraparound NSEChickory-dns
- CVE-2026-123586Hickory DNS 0.25.0-alpha.3 through 0.25.2 Query Amplification via Cyclic Referralshickory-dns
- CVE-2026-123584Hickory-DNS 0.26.0 before 0.26.2 UDP Client Denial of Service via Spoofed Responseshickory-dns
- CVE-2026-123580Hickory-DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Nonexistence Proof Forgery via NSEC3hickory-dns
- CVE-2026-123577Hickory DNS 0.24.0 before 0.26.2 DoH Unbounded Request Body Denial of Servicehickory-dns
- CVE-2026-123576Hickory DNS 0.24.0 through 0.26.1 Memory Exhaustion via DNS-over-QUIC Requestshickory-dns
- CVE-2026-123575Hickory DNS before 0.26.2 DoH Memory Exhaustion via Incomplete Request Bodieshickory-dns
- CVE-2026-123574Hickory DNS 0.24.0 before 0.26.2 Denial of Service via Zone File Parserhickory-dns
- CVE-2026-123573hickory-dns from 0.20.1 before 0.26.2 Panic in SVCB/HTTPS Zone File Parserhickory-dns
- CVE-2026-123572Hickory-dns 0.20.1 before 0.26.2 Panic DoS via SVCB/HTTPS Zone Parserhickory-dns
- CVE-2026-123571Hickory DNS from 0.26.0 before 0.26.2 Panic via TSIG RDATA Decodinghickory-dns
- CVE-2026-123570Hickory DNS from 0.18 before 0.26.2 Memory Amplification DoS via RR Countshickory-dns
- CVE-2026-123569Devalue before 5.6.3 Denial of Service via Sparse Array Serializationsveltejs devalue
- CVE-2026-123566Devalue before 5.9.3 CPU Amplification Denial of Service via unevalsveltejs devalue
- CVE-2026-123565Devalue before 5.9.3 Quadratic Expansion Denial of Service via unevalsveltejs devalue
- CVE-2026-123564Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrayssveltejs devalue
- CVE-2026-123563Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parsesveltejs devalue
- CVE-2026-123562Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejectionsveltejs devalue · devalue
- CVE-2026-123560Zebra before 7.0.0 Sync Denial of Service via Forged Checkpoint Block BodyZcashFoundation zebra
- CVE-2026-123559Zebra before 7.0.0 Denial of Service via Quadratic Sighash ComputationZcashFoundation zebra
- CVE-2026-123558Zebra before 7.0.0 Checkpoint Sync Denial of Service via Cancelled Verifier RewindZcashFoundation zebra
- CVE-2026-123557Zebra zebrad before 7.0.0 Reachable Assertion DoS via Peer DisconnectionZcashFoundation zebra
- CVE-2026-123555Zebra 2.3.0 before 7.0.0 Denial of Service via Unscored Script Verification FailuresZcashFoundation zebra
- CVE-2026-123554Zebra zebrad 6.4.0 before 7.0.0 Denial of Service via Mempool Coinbase-Maturity CheckZcashFoundation zebra
- CVE-2026-123545OpenAM 14.5.1 before 16.1.4 CSRF in OAuth 2.0 Device FlowOpenIdentityPlatform OpenAM
- CVE-2026-123543OpenAM before 16.1.4 Unauthenticated DoS via Unbounded Java DeserialisationOpenIdentityPlatform OpenAM
- CVE-2026-123542OpenAM before 16.1.4 PKCE Bypass in OAuth 2.0 Device Authorization FlowOpenIdentityPlatform OpenAM
- CVE-2026-123538OpenAM before 16.1.4 SAML 1.x Signature Verification Issuer ImpersonationOpenIdentityPlatform OpenAM
- CVE-2026-123534Tornado before 6.6 Path Traversal via static_url() Version Hashingtornadoweb tornado
- CVE-2026-123532gix-fs before 0.24.1 NTLM Credential Disclosure via Windows Symlink UNC ProbeGitoxideLabs gitoxide
- CVE-2026-123531Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parametergo-vikunja vikunja
- CVE-2026-123528Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middlewarego-vikunja vikunja
- CVE-2026-123525Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrationsgo-vikunja vikunja
- CVE-2026-123523Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cachego-vikunja vikunja
- CVE-2026-123522Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhookgo-vikunja vikunja
- CVE-2026-123520Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletiongo-vikunja vikunja
- CVE-2026-123519Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Importsgo-vikunja vikunja
- CVE-2026-123517Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpointgo-vikunja vikunja
- CVE-2026-123516Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Importgo-vikunja vikunja
- CVE-2026-123513Vikunja before 2.7.1 Auth Token Leak via API URL Changego-vikunja vikunja
- CVE-2026-123512Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logsgo-vikunja vikunja
- CVE-2026-123501Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodesgo-vikunja vikunja
- CVE-2026-123497Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discoverygo-vikunja vikunja
Medium, low and unrated 172
- CVE-2026-124501Tidelift moto AWS Batch Emulation models.py privileges managementTidelift moto
- CVE-2026-124500Fengoffice Feng Office File FilesController.class.php upload_document_image server-side request forgeryFengoffice Feng Office
- CVE-2026-124499Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injectionFengoffice Feng Office
- CVE-2026-124498Convene Azeus Convene Board Management Portal dummy_launcher.jsp cross site scriptingAzeus Convene Board Management Portal
- CVE-2026-95867Multiple vulnerabilities previously addressed in IBM SevOne Network Performance ManagementIBM SevOne Network Performance Management
- CVE-2026-17427This Power System update is being released to addressIBM OPENBMC · IBM Power Hardware Management Console
- CVE-2026-17426This Power System update is being released to addressIBM OPENBMC
- CVE-2026-16697This Power System update is being released to addressIBM OPENBMC · IBM Power Hardware Management Console
- CVE-2026-16682This Power System update is being released to addressIBM OPENBMC · IBM Hardware Management Console
- CVE-2026-93005Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026IBM Process Mining
- CVE-2026-8860IBM Verify Directory is affected by multiple vulnerabilitiesIBM Security Verify Directory · IBM Verify Directory
- CVE-2026-8642IBM Verify Directory is affected by multiple vulnerabilitiesIBM Security Verify Directory · IBM Verify Directory
- CVE-2026-8640IBM Verify Directory is affected by multiple vulnerabilitiesIBM Security Verify Directory · IBM Verify Directory
- CVE-2026-84237IBM Guardium Data Protection is affected by multiple vulnerabilitiesIBM Guardium Data Protection
- CVE-2026-84229IBM Guardium Data Protection is affected by multiple vulnerabilitiesIBM Guardium Data Protection
- CVE-2026-84228IBM Guardium Data Protection is affected by multiple vulnerabilitiesIBM Guardium Data Protection
- CVE-2026-84030IBM Guardium Data Protection is affected by multiple vulnerabilitiesIBM Guardium Data Protection
- CVE-2026-82830IBM Guardium Data Protection is affected by multiple vulnerabilitiesIBM Guardium Data Protection
- CVE-2026-81542DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-81209Sensitive Information in Log files affects IBM Sterling B2B Integrator and IBM Sterling File GatewayIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-80435DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-78636IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesIBM WebSphere Application Server - Liberty
- CVE-2026-78537IBM Guardium Key Lifecycle Manager is affected by a security vulnerabilityIBM Guardium Key Lifecycle Manager
- CVE-2026-77153IBM i is Affected By Missing Authorization Vulnerability in Host-Based Printer Subsystem []IBM i
- CVE-2026-75879Multiple vulnerabilities in IBM Content Navigator and FasterXML jackson-databind in IBM Content NavigatorIBM Content Navigator
Show all 172 entriesShow fewer entries
- CVE-2026-3684Vulnerabilities exists in IBM Cloud Pak for Data SystemIBM Cloud Pak for Data System
- CVE-2026-2700Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant CartridgeIBM watsonx Orchestrate Cartridge for Cloud Pak for Data
- CVE-2026-2477Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant CartridgeIBM watsonx Orchestrate Cartridge for Cloud Pak for Data
- CVE-2026-19307Improper Authorization vulnerability affects IBM Sterling B2B Integrator and IBM Sterling File GatewayIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-18546CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilitiesCockroachDB PostgreSQL for IBM VPC
- CVE-2026-18668Protection Mechanism Failure vulnerability affects IBM Sterling File GatewayIBM Sterling File Gateway
- CVE-2026-18525IBM Sterling Secure Proxy is vulnerable to multiple issuesIBM Secure Proxy
- CVE-2026-18484IBM ContextForge MCP Gateway is affected by a denial-of-service via tool name collision through slug normalizationIBM ContextForge MCP Gateway
- CVE-2026-18196IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injectionIBM App Connect Enterprise
- CVE-2026-18195IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injectionIBM App Connect Enterprise
- CVE-2026-18194IBM App Connect Enterprise is vulnerable to a clickjacking attackIBM App Connect Enterprise
- CVE-2026-17437IBM App Connect Enterprise is vulnerable to an arbitrary file writeIBM App Connect Enterprise
- CVE-2026-16699Vulnerability exists in IBM Netezza ApplianceIBM Netezza Appliance
- CVE-2026-16433DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-16427DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-16325DataStage on Cloud Pak for Data has several vulnerabilitiesIBM DataStage on Cloud Pak for Data
- CVE-2026-14963IBM Cognos Command Center has addressed vulnerabilitiesIBM Cognos Command Center
- CVE-2026-76052The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in…IBM Storage Scale System · IBM Storage Scale
- CVE-2026-14469IBM Storage Scale Incorrect AuthorizationIBM Storage Scale Container Native and CSI
- CVE-2026-14437IBM Storage Scale Path TraversalIBM Storage Scale Container Native and CSI
- CVE-2026-14435IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by a vulnerabilityIBM Turbonomic kubeturbo agent
- CVE-2026-14434IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by vulnerabilityIBM Turbonomic kubeturbo agent
- CVE-2026-14377IBM Turbonomic kubeturbo agent, used by IBM Turbonomic Application Resource Management, is affected by a security vulnerabilityIBM Turbonomic kubeturbo agent
- CVE-2026-14375The following vulnerabilities that can affect IBM Storage Scale Install Toolkit are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higherIBM Storage Scale
- CVE-2026-12737IBM Sterling B2B Integrator and IBM Sterling File Gateway affected by Exposure of Sensitive Information in Logs VulnerabilityIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-12735IBM Controller Disclosure Management has addressed vulnerabilitiesIBM Controller Disclosure Management
- CVE-2026-120115Multiple vulnerabilities in IBM Aspera ConnectIBM Aspera Connect
- CVE-2026-120113Multiple vulnerabilities in IBM Aspera ConnectIBM Aspera Connect
- CVE-2026-119670Vulnerabilities in spring-context, logback-core and Another JSON Schema Validator might affect IBM Storage Defender Copy Data ManagementIBM Storage Copy Data Management
- CVE-2026-116500Unbound Recursion in QPY deserialization can lead to denial of serviceIBM Qiskit SDK
- CVE-2026-115554Tivoli Netcool/OMNIbus Web GUI is vulnerable to stored cross-site scriptingIBM Tivoli Netcool/OMNIbus
- CVE-2026-11547IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesIBM WebSphere Application Server - Liberty
- CVE-2026-113698IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query TableIBM Db2
- CVE-2026-112369Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026IBM Process Mining
- CVE-2026-10844IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesIBM WebSphere Application Server - Liberty
- CVE-2026-108292Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026IBM Process Mining
- CVE-2026-108284IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesIBM WebSphere Application Server - Liberty
- CVE-2026-105473IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSSIBM QRadar
- CVE-2026-103320IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilitiesIBM WebSphere Application Server - Liberty
- CVE-2026-102618IBM i is Affected by a Protection Mechanism FailureIBM i
- CVE-2025-36075IBM Safer Payments could allow an authenticated user to obtain sensitive informationIBM Safer Payments
- CVE-2026-61987WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerabilityWC Lovers WCFM – Frontend Manager for WooCommerce
- CVE-2026-114186WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerabilityWPVibes AnyWhere Elementor
- CVE-2026-120858WordPress FluentForm plugin <= 6.2.16 - Broken Access Control vulnerabilityWP ManageNinja FluentForm
- CVE-2026-114188WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilityWPVibes AnyWhere Elementor
- CVE-2025-1837Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant CartridgeIBM watsonx Orchestrate Cartridge for Cloud Pak for Data
- CVE-2025-0166Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant CartridgeIBM watsonx Orchestrate Cartridge for Cloud Pak for Data
- CVE-2024-41786IBM Engineering Requirements Management DOORS Next for J2EE File Disclosure RuleIBM Engineering Requirements Management DOORS Next
- CVE-2026-124552Webmin through 2.670 Stored XSS via Shorewall and Shorewall6 list.cgiwebmin
- CVE-2026-124551ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpointclassroomio
- CVE-2026-124474MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.phpmeeting-room-booking-system mrbs-code
- CVE-2026-124331Jinher OA ProjectAfficheManage.aspx sql injectionJinher OA
- CVE-2026-124491SunEditor before 3.4.0 Stored XSS via FileUpload Plugin FilenameJiHong88 suneditor
- CVE-2026-124466OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uriopenemr
- CVE-2026-124452OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notesopenemr
- CVE-2026-124451OpenEMR before 8.4.0 Authorization Bypass via checkUserHasAccessToPatient in SMART on FHIRopenemr
- CVE-2026-124443Frappe before 16.35.0 Broken Access Control in File List/Report Queriesfrappe
- CVE-2026-124435OpenRemote before 1.32.2 Stored XSS via Manager Configuration Image Uploadopenremote core
- CVE-2026-124432phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-loginthorsten phpMyFAQ
- CVE-2026-124431Craft CMS 5.10.0 before 5.11.2 Unauthorized Volume Browsing via Asset Replacementcraftcms cms
- CVE-2026-124426Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Fieldcraftcms cms
- CVE-2026-124425Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Responseparse-community parse-server
- CVE-2026-124330FlowCI flow-core-x LocalFileManager LocalFileManager.java remove path traversalFlowCI flow-core-x
- CVE-2026-124329FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversalFlowCI flow-core-x
- CVE-2026-124328FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injectionFlowCI flow-core-x
- CVE-2026-124326DataLinkDC Dinky Catalogue Upload CatalogueController.java file.getOriginalFilename path traversalDataLinkDC Dinky
- CVE-2026-110132Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and ModificationSync Post With Other Site
- CVE-2026-105970BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment ConfirmationThanh Toán Quét Mã QR Code Tự Động
- CVE-2026-104639Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via WebhookRazorpay for WooCommerce
- CVE-2026-104338Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon RouteRazorpay for WooCommerce
- CVE-2026-104337Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon ApplyRazorpay for WooCommerce
- CVE-2026-104307BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_errorBackUpWordPress
- CVE-2026-96963Pie Register <= 3.8.4.15 - Contributor+ Invitation Code ModificationPie Register
- CVE-2026-96961Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data DestructionPie Register
- CVE-2026-103375Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data DisclosureAntom Payments
- CVE-2026-97195Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field DefinitionSecure Custom Fields
- CVE-2026-97194Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational FieldsSecure Custom Fields
- CVE-2026-97193Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDORSecure Custom Fields
- CVE-2026-97192Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save PathSecure Custom Fields
- CVE-2026-85344FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing AuthorizationFV Flowplayer Video Player
- CVE-2026-122085Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII DisclosureEvent Tickets Manager for WooCommerce
- CVE-2026-122062Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST APIPronamic Pay
- CVE-2026-122060WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe DisclosureWP Recipe Maker
- CVE-2026-124422SunEditor 3.0.0 before 3.4.0 Stored XSS via html.clean() Iframe Placeholderjihong88 suneditor
- CVE-2026-123613Rustls 0.23.13 before 0.23.45 TLS 1.3 Handshake Encryption Level Bypassrustls
- CVE-2026-123612rustls 0.23.44 and 0.23.45 ECH Rejection Application Data Disclosurerustls
- CVE-2026-123611rustls before 0.23.46 Key Exchange Downgrade via Unauthenticated ServerHellorustls
- CVE-2026-123610rustls before 0.23.46 Denial of Service via Brotli Certificate Decompressionrustls
- CVE-2026-123609Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 Secret Exposure via Debugrustls
- CVE-2026-123603Hickory DNS Missing IPv4-Mapped IPv6 Canonicalization Access Control Bypasshickory-dns
- CVE-2026-123600Hickory DNS hickory-proto 0.25.0-alpha.3 through 0.25.2 NSEC3 Apex NODATA Validation Bypasshickory-dns
- CVE-2026-123599Hickory DNS before 0.26.0-beta.1 DNSSEC Validation Bypass via Non-IN Class Recordshickory-dns
- CVE-2026-123598Hickory DNS 0.25.0 through 0.26.0-alpha.1 DNSSEC Bogus Answer Cache Poisoninghickory-dns
- CVE-2026-123597Hickory DNS DNSSEC Validation Cache Poisoning via Transient DS-Fetch Errorshickory-dns
- CVE-2026-123594Hickory DNS through 0.26.0-alpha.1 DNSSEC NSEC Validation Bypass for Empty Non-Terminalshickory-dns
- CVE-2026-123593Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via TrustAnchorshickory-dns
- CVE-2026-123590Hickory DNS 0.26.0-beta.1 before 0.26.2 Improper NSEC/NSEC3 Signature Validationhickory-dns
- CVE-2026-123589Hickory DNS before 0.26.2 Denial of Service via Missing DNS-over-QUIC Request Read Timeouthickory-dns
- CVE-2026-123585Hickory DNS 0.25.0 before 0.26.2 Query Amplification via Irrelevant CNAME Recordshickory-dns
- CVE-2026-123583Hickory DNS 0.25.0 through 0.25.2 Missing Bailiwick Filtering on Negative Responseshickory-dns
- CVE-2026-123582Hickory DNS 0.25.0 before 0.26.2 DNSSEC Validation Bypass via SOA Recordhickory-dns
- CVE-2026-123581Hickory DNS through 0.26.0-alpha.1 DNSSEC Validation Bypass via Unrelated RRsethickory-dns
- CVE-2026-123579Hickory DNS 0.26.0-beta.1 before 0.26.2 DNSSEC Validation Bypass via Wildcard Expansionhickory-dns
- CVE-2026-123578Hickory DNS 0.26.0 before 0.26.2 Response Validation Bypass via QDCOUNT=0hickory-dns
- CVE-2026-123568Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Outputsveltejs devalue
- CVE-2026-123567Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflattensveltejs devalue
- CVE-2026-123561Sveltejs devalue before 5.9.3 proto Rejection Bypass via Property-Key Coercionsveltejs devalue
- CVE-2026-123556Zebra 4.5.0 before 7.0.0 Honest Peer Ban via Mempool Lock-Time ScoringZcashFoundation zebra
- CVE-2026-123553OpenAM before 16.1.4 Default Credentials in Built-in Accounts Allow Unauthenticated LoginOpenIdentityPlatform OpenAM
- CVE-2026-123552OpenAM before 16.1.4 SSRF and CRL Tampering via Certificate CRL Distribution PointOpenIdentityPlatform OpenAM
- CVE-2026-123548OpenAM before 16.1.4 Open Redirect via WS-Federation and SAML v2.0 PagesOpenIdentityPlatform OpenAM
- CVE-2026-123547OpenAM before 16.1.4 Open Redirect via SAML v2.0 RelayStateOpenIdentityPlatform OpenAM
- CVE-2026-123546OpenAM before 16.1.4 Open Redirect and XSS via goto and gotoOnFailOpenIdentityPlatform OpenAM
- CVE-2026-123544OpenAM before 16.1.4 Insufficient Response Validation in Internal SOAP ChannelOpenIdentityPlatform OpenAM
- CVE-2026-123541OpenAM before 16.1.4 Open Redirect via SAML 1.x Trusted-Partner MatchingOpenIdentityPlatform OpenAM
- CVE-2026-123540OpenAM before 16.1.4 Incomplete Attribute Encoding in SAML 1.x Form POSTOpenIdentityPlatform OpenAM
- CVE-2026-123539OpenAM before 16.1.4 Stored XSS via OAuth 2.0 Consent Page Display NameOpenIdentityPlatform OpenAM
- CVE-2026-123537OpenAM before 16.1.4 SSRF via UMA Scope Description URLsOpenIdentityPlatform OpenAM
- CVE-2026-123536OpenAM before 16.1.4 SSRF via Federation Configuration Wizard Metadata URLsOpenIdentityPlatform OpenAM
- CVE-2026-123535Tornado before 6.6 Cookie Attribute Injection via set_cookie max_agetornadoweb tornado
- CVE-2026-123533Gitoxide before 0.42.0 Denial of Service via Crafted Commit-Graph FileGitoxideLabs gitoxide
- CVE-2026-123530Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpointsgo-vikunja vikunja
- CVE-2026-123529Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-colorgo-vikunja vikunja
- CVE-2026-123527Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypassgo-vikunja vikunja
- CVE-2026-123526Vikunja before 2.7.1 Mass Assignment via Team external_id Fieldgo-vikunja vikunja
- CVE-2026-123524Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payloadgo-vikunja vikunja
- CVE-2026-123521Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpointgo-vikunja vikunja
- CVE-2026-123518Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Movego-vikunja vikunja
- CVE-2026-123515Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Imagesgo-vikunja vikunja
- CVE-2026-123514Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustiongo-vikunja vikunja
- CVE-2026-123511Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entriesgo-vikunja vikunja
- CVE-2026-123510Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpathgo-vikunja vikunja
- CVE-2026-123509Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Countgo-vikunja vikunja
- CVE-2026-123508Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchaingo-vikunja vikunja
- CVE-2026-123507Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filtergo-vikunja vikunja
- CVE-2026-123506Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpointsgo-vikunja vikunja
- CVE-2026-123505Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Databasego-vikunja vikunja
- CVE-2026-123504Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Membersgo-vikunja vikunja
- CVE-2026-123503Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletiongo-vikunja vikunja
- CVE-2026-123502Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logginggo-vikunja vikunja
- CVE-2026-123500Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dumpgo-vikunja vikunja
- CVE-2026-123499Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Servergo-vikunja vikunja
- CVE-2026-123498Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadatago-vikunja vikunja
- CVE-2026-123496Vikunja veans before 2.7.1 Symlink Following in veans initgo-vikunja vikunja
- CVE-2026-123495Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callbackgo-vikunja vikunja
- CVE-2026-123494Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacksgo-vikunja vikunja
- CVE-2026-123493Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokensgo-vikunja vikunja