Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425880 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425880 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126443 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice. | ||||
| CVE-2026-126441 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 5.3 Medium |
| OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions. | ||||
| CVE-2026-126439 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 5.3 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers. | ||||
| CVE-2026-126437 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions. | ||||
| CVE-2026-126436 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 7.5 High |
| OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions. | ||||
| CVE-2026-123283 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 6.8 Medium |
| In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account | ||||
| CVE-2026-123282 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 7.4 High |
| In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session | ||||
| CVE-2026-123281 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 7.5 High |
| In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker | ||||
| CVE-2026-123280 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 8.1 High |
| In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports | ||||
| CVE-2026-123279 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 9 Critical |
| In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators | ||||
| CVE-2026-123284 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 6.5 Medium |
| In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content | ||||
| CVE-2026-17140 | 1 Ibm | 1 Api Connect | 2026-11-13 | 3.3 Low |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. Input supplied by a user can influence code generated by the product, which could lead to code execution. | ||||
| CVE-2026-18596 | 1 Synology | 1 Diskstation Manager | 2026-11-13 | 8.1 High |
| An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers with valid user credentials to read or write arbitrary files and conduct denial-of-service attacks. | ||||
| CVE-2026-126432 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 5.9 Medium |
| OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows read-only users to transmit lab orders because the patients/med check ignores write permission. Authenticated attackers can submit form_xmit with arbitrary procedure order IDs to send HL7 orders containing SSNs, insurance, and diagnoses to laboratories and mark them transmitted. | ||||
| CVE-2026-126431 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 6.8 Medium |
| OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination users to store malicious C-CDA field identifiers through the savedata action. Attackers can inject SQL into the IN clause built by fetchFormValues() during C-CDA generation to extract password hashes, portal reset values, and patient records. | ||||
| CVE-2026-126428 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 7.5 High |
| OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store attacker-controlled PHP by uploading a malformed ERA file to era_payments.php. Attackers with a database-write primitive such as SQL injection can register a background_services row whose require_once loads the stored .edi file, executing PHP as the web-server user. | ||||
| CVE-2026-126396 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-11-13 | 5.3 Medium |
| vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which accepts request-level min_pixels without range or min_pixels <= max_pixels validation. Its video-wide pixel budget is enforced only when max_long_side_pixel is set, and that value defaults to None. API clients can supply a large min_pixels via mm_processor_kwargs to enlarge every decoded frame, causing excessive CPU and host-memory consumption that may disrupt workers or the service. | ||||
| CVE-2026-126395 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-11-13 | 5.3 Medium |
| vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose lowercase-only regex fails to scrub uppercase PIL image addresses. Unauthenticated attackers can send a crafted PNG to endpoints such as /tokenize, triggering HF-processor errors that leak live server heap addresses useful for ASLR bypass. | ||||
| CVE-2026-126394 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-11-13 | 5.3 Medium |
| vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which uses request-controlled num_frames without an effective ceiling. Unauthenticated attackers can send /v1/chat/completions or /tokenize requests selecting the openpangu video_backend with a huge num_frames, forcing np.linspace allocations and CPU work that OOM-kill the API server. | ||||
| CVE-2026-126374 | 2 Givanz, Vvveb | 2 Vvveb, Vvveb | 2026-11-13 | 4.3 Medium |
| Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as backtick-quoted INSERT column names without escaping, and several procedures in admin/sql/mysqli/product.sql and admin_auth_token.sql omit the @FILTER guard. Authenticated back-office users able to save products can submit product_<feature> POST array keys containing backticks to redirect bound values into unexposed columns or break SQL statements. | ||||