Export limit exceeded: 203743 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (203743 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-36075 | 1 Ibm | 1 Safer Payments | 2026-11-08 | 5.3 Medium |
| IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information. | ||||
| CVE-2026-115718 | 1 Frappe | 1 Builder | 2026-11-08 | 4.3 Medium |
| Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and effectively turning the site into a free LLM proxy. | ||||
| CVE-2026-124425 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-08 | 3.1 Low |
| Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set. | ||||
| CVE-2026-124435 | 1 Openremote | 2 Core, Openremote | 2026-11-08 | 4.8 Medium |
| OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin. | ||||
| CVE-2026-124436 | 1 Openremote | 2 Core, Openremote | 2026-11-08 | 8 High |
| OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs. | ||||
| CVE-2026-61987 | 2026-11-08 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Stored XSS.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through 6.8.1. | ||||
| CVE-2026-114186 | 2026-11-08 | 6.5 Medium | ||
| Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-114189 | 2026-11-08 | 8.5 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-109900 | 2026-11-08 | 9.6 Critical | ||
| Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: from n/a through 1.3.0. | ||||
| CVE-2026-120858 | 2026-11-08 | 6.5 Medium | ||
| Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.16. | ||||
| CVE-2026-109899 | 2026-11-08 | 7.1 High | ||
| Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0. | ||||
| CVE-2026-114188 | 2026-11-08 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2025-1837 | 1 Ibm | 1 Watsonx Orchestrate Cartridge For Cloud Pak For Data | 2026-11-08 | 5.4 Medium |
| IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods. | ||||
| CVE-2025-0166 | 1 Ibm | 1 Watsonx Orchestrate Cartridge For Cloud Pak For Data | 2026-11-08 | 2.7 Low |
| IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible. | ||||
| CVE-2024-41786 | 1 Ibm | 1 Engineering Requirements Management Doors Next | 2026-11-08 | 5.3 Medium |
| IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation. | ||||
| CVE-2026-124492 | 1 Jihong88 | 1 Suneditor | 2026-11-08 | 7.6 High |
| SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input. | ||||
| CVE-2026-124494 | 1 Jihong88 | 1 Suneditor | 2026-11-08 | N/A |
| SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that pass the _isSafeURL() check but are decoded by browsers, executing JavaScript when victims click stored links. | ||||
| CVE-2026-124474 | 1 Meeting-room-booking-system | 1 Mrbs-code | 2026-11-08 | 6.1 Medium |
| MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view_entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions. | ||||
| CVE-2026-124553 | 1 Funstory-ai | 1 Babeldoc | 2026-11-08 | 7.5 High |
| BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares a huge range, driving billions of loop iterations and stalling the translation worker. | ||||
| CVE-2026-124439 | 1 Scriban | 1 Scriban | 2026-11-08 | 7.5 High |
| Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an uncatchable StackOverflowException that terminates the host process. | ||||