Export limit exceeded: 110944 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (110944 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109899 | 2026-11-08 | 7.1 High | ||
| Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0. | ||||
| CVE-2026-107616 | 2026-11-08 | 7.5 High | ||
| The Amelia plugin for WordPress is vulnerable to unauthorized access of attendee data due to a missing authorization check on the GetEventAttendeesCommandHandler::handle() function in versions up to, and including, 9.9.1. The handler only enforces the broad `amelia_read_events` capability — which the plugin's own `wpamelia-customer` role possesses — and does not verify that the authenticated user is an organizer/provider of the event referenced by the client-supplied `id` query parameter. This makes it possible for authenticated attackers, with wpamelia-customer-level access and above, to export the full CSV of attendee personally identifiable information (first/last name, email, phone, date of birth, gender, private notes, payment amounts/methods, WooCommerce order IDs, custom-field values, and uploaded-file URLs) for any Amelia event on the site by directly invoking the `/report/event/attendees` endpoint with an arbitrary event ID. | ||||
| CVE-2026-104738 | 2026-11-08 | 8.1 High | ||
| The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.10.2 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. Exploitation requires that an administrator has previously configured at least one active NexForms integration (status=1) in the plugin's database table; in the free tier, only POST parameter keys containing the substrings 'name', 'email', 'first', or 'last' are routed to the vulnerable normalizer. | ||||
| CVE-2026-8639 | 1 Ibm | 2 Security Verify Directory, Verify Directory | 2026-11-08 | 8.8 High |
| IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the directory management console. | ||||
| CVE-2026-124492 | 1 Jihong88 | 1 Suneditor | 2026-11-08 | 7.6 High |
| SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input. | ||||
| CVE-2026-73570 | 2 Synacor, Zimbra | 2 Zimbra Collaboration Suite, Collaboration | 2026-11-08 | 8.9 High |
| A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. | ||||
| CVE-2026-124437 | 1 Scriban | 1 Scriban | 2026-11-08 | 7.5 High |
| Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts. | ||||
| CVE-2026-124438 | 1 Scriban | 1 Scriban | 2026-11-08 | 7.4 High |
| Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths. | ||||
| CVE-2026-53985 | 1 Efstratios Goudelis | 1 Ground Station | 2026-11-08 | 7.5 High |
| Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition. | ||||
| CVE-2026-49948 | 1 Mem0ai | 1 Mem0 | 2026-11-08 | 8.1 High |
| Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configure endpoint modifies global LLM provider and embedder configuration but only verifies authentication via JWT or X-API-Key without validating the caller's role. Any authenticated user holding a distributed API key can redirect all LLM and embedder traffic to an attacker-controlled server, with the malicious configuration persisted to PostgreSQL and surviving server restarts to affect all users and API keys on the instance. | ||||
| CVE-2026-29001 | 1 Tastyigniter | 1 Tastyigniter | 2026-11-08 | 7.2 High |
| TastyIgniter through 4.4.5 contains a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code execution by submitting a serialized PHP object as a settings value, which is stored unsanitized and later unserialized by getValueAttribute() when the setting is read. Attackers can submit a serialized gadget chain, such as one generated via phpggc, through the admin settings form (for example the maintenance_message setting loaded by CheckMaintenance.php) to achieve arbitrary operating-system command execution as the PHP application process user, with the impact persisting until the value is overwritten. | ||||
| CVE-2026-116818 | 1 Openpanel | 1 Openpanel | 2026-11-08 | 8.2 High |
| OpenPanel before 3.0.0 contains an unauthenticated ClickHouse SQL injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId WebSocket, which lacks session and project-access checks. Attackers can use UNION or boolean count oracles to read other tenants' events and profiles, and project members can similarly inject via the cohort.preview timeframe values. | ||||
| CVE-2026-109429 | 1 Mistral | 1 Mistral-vibe | 2026-11-08 | 8.8 High |
| Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hiding a command substitution inside a single-quoted variable value that tree-sitter-bash static parsing cannot detect. Attackers can craft input such as embedding a command substitution within a single-quoted variable and re-expanding it with the ${var@P} prompt-transform operator so bash's promptvars feature executes the hidden command at runtime while only the trailing allowlisted command is classified, resulting in silent arbitrary command execution with the privileges of the agent's terminal session. | ||||
| CVE-2026-109428 | 1 Mistral | 1 Mistral-vibe | 2026-11-08 | 8.8 High |
| Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in the _extract_commands() function of bash.py. Attackers can craft a command string where tree-sitter-bash extracts only an allowlisted prefix such as cd while bash joins the line continuation into a materially different and hidden command such as a curl request, causing resolve_permission to grant ALWAYS permission while bash executes unauthorized arbitrary commands. | ||||
| CVE-2010-20125 | 1 Dedecms | 1 Dedecms | 2026-11-08 | 7.5 High |
| DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to require_once. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18. | ||||
| CVE-2026-124331 | 1 Jinher | 1 Oa | 2026-11-08 | 7.3 High |
| A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-124489 | 1 Open-emr | 1 Openemr | 2026-11-08 | 7.1 High |
| OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and form_pid parameters to view payment pages and record fraudulent payment receipts for arbitrary patients, corrupting billing records. | ||||
| CVE-2026-124488 | 1 Open-emr | 1 Openemr | 2026-11-08 | 8.1 High |
| OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records. | ||||
| CVE-2026-124484 | 1 Open-emr | 1 Openemr | 2026-11-08 | 8.8 High |
| OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data. | ||||
| CVE-2026-124480 | 1 Open-emr | 1 Openemr | 2026-11-08 | 8.8 High |
| OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI. | ||||