Export limit exceeded: 421837 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421837 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-2700 | 1 Ibm | 1 Watsonx Orchestrate Cartridge For Cloud Pak For Data | 2026-11-09 | 4.3 Medium |
| IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 allows low-privileged users to execute administrative functions by directly invoking backend APIs.As a result, UI-level access restrictions are ineffective, as the backend fails to enforce role-based access control. | ||||
| CVE-2026-18668 | 1 Ibm | 1 Sterling File Gateway | 2026-11-09 | 6.5 Medium |
| IBM Sterling File Gateway 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 - 6.2.2.1_1 could allow a remote attacker to perform protocol downgrade attacks due to a security misconfiguration. | ||||
| CVE-2026-18195 | 1 Ibm | 1 App Connect Enterprise | 2026-11-09 | 4.2 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to perform content spoofing due to improper output encoding of error messages. | ||||
| CVE-2026-17426 | 1 Ibm | 1 Openbmc | 2026-11-09 | 6.5 Medium |
| IBM Power Systems Firmware FW1060.00 through FW1060.81 could allow a remote attacker to cause a denial of service due to an unhandled exception. | ||||
| CVE-2026-17401 | 1 Ibm | 1 Api Connect | 2026-11-09 | 7.2 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overflow. | ||||
| CVE-2026-17354 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.9 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal. | ||||
| CVE-2026-17340 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.8 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability. | ||||
| CVE-2026-17335 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.8 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to path traversal. File paths in uploaded content are not sufficiently validated, which could allow files to be written outside the intended location and code to be executed. | ||||
| CVE-2026-17239 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.9 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to a path traversal vulnerability. | ||||
| CVE-2026-16699 | 1 Ibm | 1 Netezza Appliance | 2026-11-09 | 6.5 Medium |
| IBM Netezza Appliance 11.3.0.2 Interim Fix 002 through 11.3.1.3 Interim Fix 006 could allow a remote authenticated attacker to change the passwords of other users due to improper authorization. | ||||
| CVE-2026-124566 | 1 Fushengqian | 1 Fuint | 2026-11-09 | 4.3 Medium |
| A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Performing a manipulation results in enforcement of behavioral workflow. The attack is possible to be carried out remotely. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-124562 | 2 D-link, Dlink | 2 Dir-878, Dir-878 | 2026-11-09 | 7.5 High |
| A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-124557 | 1 Ottermind | 1 Chat2db | 2026-11-09 | 7.3 High |
| A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-124553 | 1 Funstory-ai | 1 Babeldoc | 2026-11-09 | 7.5 High |
| BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares a huge range, driving billions of loop iterations and stalling the translation worker. | ||||
| CVE-2026-124509 | 1 Floci-io | 1 Floci | 2026-11-09 | 7.3 High |
| A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component. | ||||
| CVE-2026-124505 | 1 Dianping | 1 Cat | 2026-11-09 | 4.3 Medium |
| A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-124500 | 1 Fengoffice | 1 Feng Office | 2026-11-09 | 6.3 Medium |
| A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipulation of the argument url results in server-side request forgery. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-124491 | 1 Jihong88 | 1 Suneditor | 2026-11-09 | 6.4 Medium |
| SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean() and execute JavaScript in victims' browsers when content or gallery items load, enabling session theft. | ||||
| CVE-2026-124487 | 1 Open-emr | 1 Openemr | 2026-11-09 | 6.5 Medium |
| OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data. | ||||
| CVE-2026-124483 | 1 Open-emr | 1 Openemr | 2026-11-09 | 8.3 High |
| OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide. | ||||