CVE Field Guide

Critical CVEs

CVE Title Updated Score
CVE-2026-124577 Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication 09.11.2026 9.3
CVE-2026-113363 09.11.2026 9.3
CVE-2026-113364 09.11.2026 9.3
CVE-2026-124560 D-Link DIR-878 HNAP prog.cgi GetCAPTCHAsetting heap-based overflow 09.11.2026 9.3
CVE-2026-119506 WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability 09.11.2026 9.1
CVE-2026-6715 Multiple Vulnerabilities in IBM Concert Software 08.11.2026 9.8
CVE-2026-17466 IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities 08.11.2026 9.1
CVE-2026-15266 Multiple Vulnerabilities in IBM Concert Software 08.11.2026 9.8
CVE-2026-114464 Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026 08.11.2026 9.3
CVE-2026-107331 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 9.9
CVE-2026-101117 IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks. 08.11.2026 9.1
CVE-2026-109900 WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability 08.11.2026 9.6
CVE-2026-124427 Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next 08.11.2026 9.3
CVE-2026-124438 Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access 08.11.2026 9.1
CVE-2026-124440 Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass 08.11.2026 9.4
CVE-2026-124445 OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force 08.11.2026 9.3
CVE-2026-124450 OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument 08.11.2026 9.3
CVE-2026-124463 OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View 08.11.2026 9.3
CVE-2026-124469 OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter 08.11.2026 9.4
CVE-2026-124490 OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument 08.11.2026 9.4
CVE-2026-124493 SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent 08.11.2026 9.3
CVE-2026-124494 SunEditor before 3.4.0 Stored XSS via &colon; Entity Sanitizer Bypass 08.11.2026 9.3
CVE-2026-123549 OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass 08.11.2026 9.3
CVE-2026-123550 OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions 08.11.2026 9.3
CVE-2026-123551 OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket 08.11.2026 10
CVE-2026-123614 imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow 08.11.2026 9.3
CVE-2026-124060 TOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow 07.11.2026 9.4
CVE-2026-124059 TOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow 07.11.2026 9.4
CVE-2026-124058 TOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow 07.11.2026 9.4
CVE-2026-124057 TOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow 07.11.2026 9.4
CVE-2026-123966 Tenda AC19 saveParentControlInfo heap-based overflow 07.11.2026 10
CVE-2026-120984 Keycloak-services: keycloak-services: manage-clients to arbitrary code execution through inline javascript policy import 07.11.2026 9.1
CVE-2026-122041 Checkout Field Editor for WooCommerce (Pro) <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attachment_id' Parameter via thwcfe_remove_uploaded AJAX Action 07.11.2026 9.1
CVE-2026-104014 Naimur Email OTP Verification for WooCommerce <= 2.1.0 - Unauthenticated Authentication Bypass to Account Takeover via Abandoned Password Reset Finalization 07.11.2026 9.8
CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter 08.11.2026 9.1
CVE-2026-119075 Registration Form for WooCommerce <= 1.1.4 - Unauthenticated Privilege Escalation to 'user_roles' Parameter at Checkout 07.11.2026 9.8
CVE-2026-123961 TOTOLINK CA300-PoE cstecgi.cgi setWiFiBasicConfig buffer overflow 07.11.2026 9.4
CVE-2026-123960 TOTOLINK CA300-PoE cstecgi.cgi setWanConfig buffer overflow 07.11.2026 9.4
CVE-2026-123959 TOTOLINK CA300-PoE cstecgi.cgi setLanguageCfg buffer overflow 07.11.2026 9.4
CVE-2026-123958 TOTOLINK CA300-PoE cstecgi.cgi setLanConfig buffer overflow 07.11.2026 9.4
CVE-2026-123957 TOTOLINK CA300-PoE cstecgi.cgi setIpQosRules buffer overflow 07.11.2026 9.4
CVE-2026-18535 IBM API Connect Denial of Service 08.11.2026 9.6
CVE-2026-16720 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-16884 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-16918 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-16920 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17049 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17066 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17117 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17131 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17132 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17134 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17146 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17147 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17150 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17158 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17239 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17278 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17292 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17296 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17297 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17298 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17299 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17301 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17313 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17329 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17336 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17338 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17339 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.1
CVE-2026-17340 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.8
CVE-2026-17342 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17344 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-17353 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17354 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17359 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17360 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-17392 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17394 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17396 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.6
CVE-2026-17399 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.9
CVE-2026-17402 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-17403 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9
CVE-2026-17408 Multiple Vulnerabilities in IBM API Connect 09.11.2026 9.8
CVE-2026-17409 Multiple Vulnerabilities in IBM API Connect 08.11.2026 9.4
CVE-2026-17410 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.9
CVE-2026-18836 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.3
CVE-2026-18838 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.4
CVE-2026-123218 IBM Aspera Faspex Authorization Bypass 07.11.2026 9.8
CVE-2026-19803 Printcart Store <= 2.13.2 - Unauthenticated Arbitrary File Upload via nbu_crop_image 'url' Parameter 08.11.2026 9.8
CVE-2026-17362 Multiple Vulnerabilities in IBM API Connect 07.11.2026 9.8
CVE-2026-93754 payever – WooCommerce Gateway <= 4.8.0 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution 08.11.2026 9.8
CVE-2026-109469 Entra Device Registration Elevation of Privilege Vulnerability 06.11.2026 10
CVE-2026-59104 UgCS server HCI authentication bypass with empty credentials 06.11.2026 9.3
CVE-2026-68935 Chartbrew: SSRF to Internal Network via User-Controlled allowPrivateHost Flag on API Connections 06.11.2026 9.1
CVE-2026-54349 Chartbrew SQL injection in dashboard filter substitution 06.11.2026 9.8
CVE-2026-85295 Chartbrew: Full account takeover via JWTs accepted under default CB_SECRET 06.11.2026 9.8
CVE-2026-86005 Chartbrew: Unauthenticated BullMQ Admin Dashboard Exposure in Chartbrew 06.11.2026 9.3
CVE-2026-102530 JupyterLab Desktop: Cross-Site Scripting (XSS) leading to Remote Code Execution on Connect URL 06.11.2026 9.4
CVE-2026-86044 JupyterLab Desktop: One-Click Jupyter Server Token Leak leading to Remote Code Execution 06.11.2026 9.6
CVE-2026-63438 2FAuth: Reverse Proxy Guard Auto-Creates Users With Admin Promotion From Unauthenticated Header Value 06.11.2026 9.8
CVE-2026-63439 2FAuth: Reverse Proxy Guard Trusts Client-Supplied Headers Without Proxy Verification 06.11.2026 9.8
CVE-2026-58490 Tracecat: Unsigned SAML response accepted in Docker Compose SAML deployments due to empty signing defaults 06.11.2026 9.8
CVE-2026-124040 CivetWeb through 1.16 HTTP/2 Use-After-Free via Stale Pseudo-Header State 06.11.2026 9.2
CVE-2026-119923 Heap-based Buffer Overflow in Babelfish for PostgreSQL TDS Prelogin Parser 07.11.2026 9.3
CVE-2026-71495 Wanderer: SSRF Vulnerability in /api/v1/trail/download - Unvalidated URL Leads to Internal Network Access 06.11.2026 10
CVE-2026-122193 OS command injection in the example SSM documents in Trusted Remote Execution (REX) 06.11.2026 9.3
CVE-2026-123831 07.11.2026 9.6
CVE-2026-123832 07.11.2026 9.6
CVE-2026-123488 Craft CMS 4.0.0 before 4.18.9 SQL Injection via Element Search Endpoint 06.11.2026 9.3
CVE-2026-59105 Universal sysadmin credential vulnerability in Jumis 06.11.2026 9.3
CVE-2026-107622 BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameter 06.11.2026 9.8
CVE-2026-114630 ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path' Parameter 06.11.2026 9.1
CVE-2026-123279 06.11.2026 9
CVE-2026-123294 07.11.2026 9.6
CVE-2026-119516 WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability 07.11.2026 9.8
CVE-2026-120844 WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability 06.11.2026 9.8
CVE-2026-118423 WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload 06.11.2026 10
CVE-2026-88800 MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion 06.11.2026 9.1
CVE-2026-63017 Subnet Solutions PowerSYSTEM Center Incorrect Authorization 06.11.2026 9.4
CVE-2026-63774 Subnet Solutions PowerSYSTEM Center SQL Injection 06.11.2026 9.4
CVE-2026-77596 Kubeflow Pipelines API server lacks authorization for shared pipeline uploads 05.11.2026 9.6
CVE-2026-111494 Incorrect validation of TLS certificates in the MatchPoint Android app 05.11.2026 9.1
CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API 05.11.2026 9.9
CVE-2026-111489 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform 05.11.2026 9.9
CVE-2026-119757 BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure 05.11.2026 9.3
CVE-2026-48705 MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass) 05.11.2026 9.3
CVE-2026-85076 Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401) 05.11.2026 9
CVE-2026-46350 dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS 05.11.2026 9.1
CVE-2026-102940 OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment 05.11.2026 9.6
CVE-2026-116790 FreeSWITCH: Inbound ICE connectivity checks are accepted without verifying STUN MESSAGE-INTEGRITY 05.11.2026 9.1
CVE-2026-116779 FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands 07.11.2026 9.8
CVE-2026-116785 FreeSWITCH: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling 05.11.2026 9.1
CVE-2026-100358 SuiteCRM: Admin OS RCE via Dropdown Editor PHP Injection 05.11.2026 9.4
CVE-2026-71550 SuiteCRM: LFI to RCE via AOW_WorkFlow 05.11.2026 9.9
CVE-2026-123198 LMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID> 05.11.2026 9.3
CVE-2026-54143 OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution 05.11.2026 9.8
CVE-2026-54141 OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec` 05.11.2026 9
CVE-2026-119344 Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks 05.11.2026 9.1
CVE-2026-117691 Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter names 07.11.2026 9.1
CVE-2026-121489 Apache Juneau: Path traversal in DirectoryResource allows reading files outside the configured root directory 05.11.2026 10
CVE-2026-73099 Apache Juneau: Cross-site request forgery via default-enabled content query-parameter body override 05.11.2026 10
CVE-2026-73100 Apache Juneau: Sensitive request headers logged in cleartext by the default request logger on server errors 05.11.2026 10
CVE-2026-73101 Apache Juneau: Internal exception class and message disclosed via error response header and body regardless of secure defaults 05.11.2026 10
CVE-2026-73116 Apache Juneau: REST client forwards credentials to a different origin when following HTTP redirects 05.11.2026 10
CVE-2026-73117 Apache Juneau: Response header CRLF injection and open redirect when applications set headers or redirect targets from request data 05.11.2026 10
CVE-2026-96677 Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome 05.11.2026 10
CVE-2026-73098 Apache Juneau: Unsafe reflection allows attacker-controlled class initialization during parsing 05.11.2026 10
CVE-2026-100109 Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user 05.11.2026 9.8
CVE-2026-123025 05.11.2026 9.4
CVE-2026-122992 05.11.2026 9.2
CVE-2026-122302 Kyverno before 1.19.2 Privilege Escalation via Generate Rule Permission Check 05.11.2026 9.3
CVE-2026-122303 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy 05.11.2026 9.4
CVE-2026-122304 Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader 05.11.2026 9.4
CVE-2026-122310 Kyverno 1.19.1 before 1.19.2 Privilege Escalation via Policy apiCall urlPath 05.11.2026 9.4
CVE-2026-122311 Kyverno 1.16.0 before 1.19.2 Path Traversal in Namespaced CEL Policies via resource argument 05.11.2026 9.4
CVE-2026-122313 Kyverno 1.17.0 before 1.19.2 Cross-Namespace Privilege Escalation via NamespacedMutatingPolicy 05.11.2026 9.4
CVE-2026-122051 Edimax BR-6208AC mp command injection 05.11.2026 10
CVE-2026-115770 Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing 04.11.2026 9.6
CVE-2026-52848 GLPI: MFA bypass 04.11.2026 9.2
CVE-2026-54384 VitaFit Cloud API Authentication Bypass via POST /front/login/sns/ 04.11.2026 9.3
CVE-2026-54378 VitaFit Cloud API Broken Access Control via S3 Token Endpoint 04.11.2026 9.3
CVE-2026-57566 Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy 05.11.2026 9.3
CVE-2026-102894 GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover 06.11.2026 9.1
CVE-2026-102895 GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin 06.11.2026 9.8
CVE-2026-97693 Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise 04.11.2026 9.9
CVE-2026-82418 IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL 09.11.2026 9.8
CVE-2026-122013 Comfast CF-WR632AX Multipart webmgnt path traversal 04.11.2026 10
CVE-2025-71457 vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php 05.11.2026 9.3
CVE-2026-113373 Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again 04.11.2026 9.1
CVE-2026-122220 WPO365 LOGIN before 45.2 SAML Replay Protection Bypass 05.11.2026 9.1
CVE-2026-121933 Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication 04.11.2026 10
CVE-2026-107846 bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list 04.11.2026 9.3
CVE-2026-113780 ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary 05.11.2026 9.3
CVE-2026-121932 Linksys E5350 apply.cgi system os command injection 04.11.2026 10
CVE-2026-121931 Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection 04.11.2026 9.4
CVE-2026-121930 Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection 04.11.2026 9.4
CVE-2026-122120 05.11.2026 9
CVE-2026-121952 FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability 04.11.2026 9.3
CVE-2026-121953 FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close 04.11.2026 9.3
CVE-2026-121638 WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks 04.11.2026 9.1
CVE-2026-121639 WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service 04.11.2026 9.2
CVE-2026-121640 WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions 04.11.2026 9.1
CVE-2026-122006 05.11.2026 9.8
CVE-2026-121939 Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking 04.11.2026 9.2
CVE-2026-119481 WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability 04.11.2026 9.8
CVE-2026-65555 WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability 04.11.2026 9.8
CVE-2026-114424 Code execution through double evaluation in address replacement rules 04.11.2026 9.2
CVE-2026-114425 Forged LFT metadata permits arbitrary file read and deletion 04.11.2026 9.2
CVE-2026-121802 06.11.2026 9.1
CVE-2026-121615 Linksys E5600 Login mesh_login.cgi improper authentication 04.11.2026 10
CVE-2026-121609 Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials 04.11.2026 10
CVE-2026-121607 Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection 04.11.2026 10
CVE-2026-121606 Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification 04.11.2026 10
CVE-2026-121600 TOTOLINK A950RG MAC Filter cstecgi.cgi setMacFilterRules stack-based overflow 04.11.2026 9.4
CVE-2026-121598 TOTOLINK A950RG Basic Wireless Configuration cstecgi.cgi strcpy stack-based overflow 04.11.2026 9.4
CVE-2026-121599 TOTOLINK A950RG Multi-SSID Configuration cstecgi.cgi delWiFiMultipleConfig stack-based overflow 07.11.2026 9.4
CVE-2026-121597 TOTOLINK A950RG Easy Setup Wizard cstecgi.cgi setAppEasyWizardConfig stack-based overflow 04.11.2026 9.4
CVE-2026-92189 Quest Foglight for Databases writeTopologySectionToFile External Control of File Path Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-114549 NoMachine nxwebrunner Heap-based Buffer Overflow Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-92188 Quest Foglight for Databases ForgeMBeanServerSupport Missing Authentication Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2026-92190 Quest Foglight for Databases baseRmiServiceExporter Deserialization of Untrusted Data Remote Code Execution Vulnerability 06.11.2026 9.8
CVE-2022-29966 Emerson Ovation Missing Authentication for Critical Functionality 06.11.2026 9.3
CVE-2026-22058 CVE-2026-22058 Authentication Bypass Vulnerability in StorageGRID (formerly StorageGRID Webscale) 05.11.2026 9.1
CVE-2026-112354 Etrel INCH AC Charging Station Hard-coded Default Credentials 07.11.2026 9.3
CVE-2026-119084 Remote Code Execution via Unsafe Class Loading in Amazon Redshift JDBC Driver Connection Parameters 06.11.2026 9.2
CVE-2026-82158 03.11.2026 9
CVE-2026-115731 Report Deserialization Code Execution 06.11.2026 9.4
CVE-2026-115732 Certificate Name Authorization Bypass 06.11.2026 9
CVE-2026-95860 node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions 07.11.2026 9.1
CVE-2026-95731 Unauthenticated Hardcoded Password Vulnerabilities in HPE Networking Fabric Composer Command-Line Interface allow Unauthorized Administrative Access 03.11.2026 9.8
CVE-2026-95732 Authentication Bypass in HPE Networking Fabric Composer allows Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-95733 Use of Hardcoded Credentials in HPE Networking Fabric Composer Could Allow Adjacent Arbitrary Code Execution 03.11.2026 9.6
CVE-2026-63469 fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict 03.11.2026 9.3
CVE-2026-63470 fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring 03.11.2026 9.3
CVE-2026-63471 fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator 07.11.2026 9.3
CVE-2026-112917 Docker Desktop WSL2 AF_VSOCK isolation bypass via 32-bit socketcall 04.11.2026 9.2
CVE-2026-44266 Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels 03.11.2026 9.8
CVE-2026-44267 Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter 07.11.2026 9.8
CVE-2026-28336 SolarWinds Dameware Command Injection Vulnerability 04.11.2026 9.9
CVE-2026-121260 Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection 03.11.2026 9.4
CVE-2026-121392 FreeRDP before 3.32.2 Certificate Identity Validation Bypass via tls_verify_certificate 03.11.2026 9.1
CVE-2026-89292 Unauthenticated SSRF with MNESTIX_BACKEND_API_KEY disclosure in Eclipse Mnestix Browser server actions for configured Infrastructures 03.11.2026 9.2
CVE-2026-121022 Default Administrator Password Change Not Enforced in Axxon One Web Client 03.11.2026 9.2
CVE-2026-4052 Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager) 03.11.2026 9.8
CVE-2026-13594 Improper Access Control vulnerability 04.11.2026 9.1
CVE-2026-120518 BuddyPress XProfile Image Field <= 3.1.0 - Unauthenticated Arbitrary File Deletion via Signup Image Field Activation Handler 07.11.2026 9.1
CVE-2026-120534 Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type 03.11.2026 9.8
CVE-2026-86596 s2Member <= 260927 - Unauthenticated Remote Code Execution via 'item_name' IPN Parameter 08.11.2026 9.8
CVE-2026-116769 Authentication bypass in Secure Access Servers 06.11.2026 9.3
CVE-2026-97718 CSRF in Secure Access Server v14.60 06.11.2026 9.4
CVE-2026-102435 Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via CF7 Form Field 03.11.2026 9.8
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 05.11.2026 9.5
CVE-2026-105604 Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 05.11.2026 9.3
CVE-2026-105603 Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 05.11.2026 9.4
CVE-2026-119085 Template injection in the publishing component of awslabs Virtual Engineering Workbench 03.11.2026 9.4
CVE-2026-105769 kaniko can send the build's Azure (Entra ID) access token to lookalike ACR registry hosts 02.11.2026 9.3
CVE-2026-88811 Rancher credentials disclosed to third-party hosts by the Rancher Manager meta proxy 03.11.2026 9.1

Latest Updates

CVE Title Updated Score
CVE-2026-120386 09.11.2026
CVE-2026-124579 aaPanel BillionMail Relay Configuration API relay.go injection 09.11.2026
CVE-2026-124578 Pantum BP5100DW Web omDB.shtml missing authentication 09.11.2026
CVE-2026-124577 Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication 09.11.2026
CVE-2026-124576 BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow 09.11.2026
CVE-2026-124575 SiteServer SSCMS Admin-Login CAPTCHA LoginController.Submit.cs LoginController.Submit excessive authentication 09.11.2026
CVE-2026-124574 chenyme grok2api Video Job Retry video.go beginSelectionSession improper authorization 09.11.2026
CVE-2026-115204 AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import 09.11.2026
CVE-2026-115212 mView <= 1.0.3 - Subscriber+ Arbitrary File Upload 09.11.2026
CVE-2026-115213 EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass 09.11.2026
CVE-2026-115237 Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code 09.11.2026
CVE-2026-115256 Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover 09.11.2026
CVE-2026-118201 Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC 09.11.2026
CVE-2026-118202 Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header 09.11.2026
CVE-2026-120409 All-in-One Video Gallery < 5.1.1 - Unauthenticated Password-Protected Video Disclosure via Player Page and Download Handler 09.11.2026
CVE-2026-121759 Fusion Page Builder < 1.7.1 - Contributor+ Arbitrary Post Trashing via IDOR 09.11.2026
CVE-2026-121874 Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name 09.11.2026
CVE-2026-121875 Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment 09.11.2026
CVE-2026-123064 WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation 09.11.2026
CVE-2026-123088 UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure 09.11.2026
CVE-2026-123091 Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms 09.11.2026
CVE-2026-123128 GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition 09.11.2026
CVE-2026-123129 Event Tickets Manager for WooCommerce 1.5.4 - 1.5.9 - Unauthenticated Site-wide Event Ticket Price Manipulation 09.11.2026
CVE-2026-123131 GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass 09.11.2026
CVE-2026-123145 WooCommerce Stripe Payment Gateway 10.9.0 - 11.0.1 - Customer Password Stored in Plaintext via Express Checkout 09.11.2026
CVE-2026-123751 WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass 09.11.2026
CVE-2026-124572 DataLinkDC dinky Catalogue Upload API CatalogueController.java CatalogueController.upload path traversal 09.11.2026
CVE-2026-124573 logseq Local HTTP API server.cljs validate-auth-token missing authentication 09.11.2026
CVE-2026-81422 Advanced Appointment Booking & Scheduling < 2.7 - Unauthenticated Arbitrary User Registration 09.11.2026
CVE-2026-124571 SourceCodester Simple CRUD using PHP and FPDF register.php sql injection 09.11.2026
CVE-2026-124570 SourceCodester Online Leave Management System Employee Avatar Upload Extension Master.php cross site scripting 09.11.2026
CVE-2026-124569 fushengqian fuintCatering CommissionCashServiceImpl.java updateCommissionCash access control 09.11.2026
CVE-2026-124568 fushengqian fuintCatering Refund Agreement RefundServiceImpl.agreeRefund access control 09.11.2026
CVE-2026-124567 fushengqian fuint ClientOrderController.java receipt state issue 09.11.2026
CVE-2026-124566 fushengqian fuint Alipay Callback ClientPayController.java aliPayCallback behavioral workflow 09.11.2026
CVE-2026-113363 09.11.2026
CVE-2026-113364 09.11.2026
CVE-2026-124565 fushengqian fuint Order Verification MerchantOrderController.java confirm access control 09.11.2026
CVE-2026-113362 09.11.2026
CVE-2026-124564 D-Link DIR-878 HNAP prog.cgi GetListDirectory path traversal 09.11.2026
CVE-2026-124563 D-Link DIR-878 HNAP SetWanSettings buffer overflow 09.11.2026
CVE-2026-124610 09.11.2026
CVE-2026-124562 D-Link DIR-878 HNAP SetWanSettings buffer overflow 09.11.2026
CVE-2026-124561 D-Link DIR-878 HNAP prog.cgi SetVLANSettings stack-based overflow 09.11.2026
CVE-2026-121825 Open redirect in the Liberty ID-FF service provider single sign-on flow 09.11.2026
CVE-2026-124560 D-Link DIR-878 HNAP prog.cgi GetCAPTCHAsetting heap-based overflow 09.11.2026
CVE-2026-124558 DataLinkDC Dinky sql-gateway Endpoint SqlGateway.java SqlGateway.onOpen server-side request forgery 09.11.2026
CVE-2026-124557 OtterMind Chat2DB Class Generator DbMybatisGenerateServiceImpl.java DbMybatisGenerateServiceImpl.generateClass path traversal 09.11.2026
CVE-2026-124556 kekingcn kkFileView BaseUrlFilter.java BaseUrlFilter.getBaseUrl redirect 09.11.2026
CVE-2026-124555 JeecgBoot Table Dictionary API getTableDictList JimuFormApiService.getTableDictList sql injection 09.11.2026
CVE-2026-124554 JeecgBoot JimuBI getAllChartData sql injection 09.11.2026
CVE-2026-124509 floci-io Floci S3 Destination Configuration DeliveryStreamDescription.java S3Destination.bucketName path traversal 09.11.2026
CVE-2026-124508 floci-io Floci Artifact CodeBuildJsonHandler.java BuildspecParser.parseArtifacts path traversal 09.11.2026
CVE-2026-124507 conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery 09.11.2026
CVE-2026-119506 WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Privilege Escalation vulnerability 09.11.2026 9.1
CVE-2026-124506 Dianping CAT Report hourlyReport.tag Model.getDomain cross site scripting 09.11.2026
CVE-2026-124504 erupts erupt ReportService.java ReportService.queryBiData sql injection 09.11.2026
CVE-2026-124505 Dianping CAT Login/Logout Handler.java Handler.redirect 09.11.2026
CVE-2026-124502 yungifez Skuul School Management System Delete GraduationController.php resetGraduation authorization 09.11.2026
CVE-2026-124501 Tidelift moto AWS Batch Emulation models.py privileges management 08.11.2026
CVE-2026-124500 Fengoffice Feng Office File FilesController.class.php upload_document_image server-side request forgery 08.11.2026
CVE-2026-124499 Fengoffice Feng Office Translation Tool ToolController.class.php write_translations code injection 08.11.2026
CVE-2026-124498 Convene Azeus Convene Board Management Portal dummy_launcher.jsp cross site scripting 08.11.2026
CVE-2026-118904 IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication. 08.11.2026 8.1
CVE-2026-95867 Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management 09.11.2026 6.7
CVE-2026-96146 Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management 08.11.2026 7.5
CVE-2026-17427 This Power System update is being released to address 08.11.2026 6.5
CVE-2026-16682 This Power System update is being released to address 08.11.2026 6.5
CVE-2026-16697 This Power System update is being released to address 08.11.2026 6.5
CVE-2026-17426 This Power System update is being released to address 08.11.2026 6.5
CVE-2026-97677 Langflow OSS is affected by multiple vulnerabilities 08.11.2026 8.1
CVE-2026-9764 IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution 08.11.2026 8.8
CVE-2026-84229 IBM Guardium Data Protection is affected by multiple vulnerabilities 08.11.2026 6.5
CVE-2026-84237 IBM Guardium Data Protection is affected by multiple vulnerabilities 08.11.2026 3.1
CVE-2026-8639 IBM Verify Directory is affected by multiple vulnerabilities 09.11.2026 8.8
CVE-2026-8640 IBM Verify Directory is affected by multiple vulnerabilities 08.11.2026 3.5
CVE-2026-8642 IBM Verify Directory is affected by multiple vulnerabilities 08.11.2026 4.3
CVE-2026-8860 IBM Verify Directory is affected by multiple vulnerabilities 08.11.2026 6.5
CVE-2026-93005 Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026 08.11.2026 6.5
CVE-2026-93879 Hibernate Validator is affected by an expression language injection vulnerability 08.11.2026 7.5
CVE-2026-6715 Multiple Vulnerabilities in IBM Concert Software 08.11.2026 9.8
CVE-2026-75879 Multiple vulnerabilities in IBM Content Navigator and FasterXML jackson-databind in IBM Content Navigator 08.11.2026 4.3
CVE-2026-77153 IBM i is Affected By Missing Authorization Vulnerability in Host-Based Printer Subsystem [] 08.11.2026 4.8
CVE-2026-78537 IBM Guardium Key Lifecycle Manager is affected by a security vulnerability 08.11.2026 6.8
CVE-2026-78636 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities 08.11.2026 4.3
CVE-2026-80435 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 5
CVE-2026-81209 Sensitive Information in Log files affects IBM Sterling B2B Integrator and IBM Sterling File Gateway 08.11.2026 4.9
CVE-2026-81542 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 6.4
CVE-2026-82830 IBM Guardium Data Protection is affected by multiple vulnerabilities 09.11.2026 6.7
CVE-2026-84030 IBM Guardium Data Protection is affected by multiple vulnerabilities 08.11.2026 5.6
CVE-2026-84228 IBM Guardium Data Protection is affected by multiple vulnerabilities 08.11.2026 3.1
CVE-2026-2477 Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge 08.11.2026 6.5
CVE-2026-2700 Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge 08.11.2026 4.3
CVE-2026-3684 Vulnerabilities exists in IBM Cloud Pak for Data System 08.11.2026 6.5
CVE-2026-19133 TS4500 Tape Library addresses security vulnerability 08.11.2026 8.1
CVE-2026-19307 Improper Authorization vulnerability affects IBM Sterling B2B Integrator and IBM Sterling File Gateway 08.11.2026 4.3
CVE-2026-18893 CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities 08.11.2026 7.1
CVE-2026-18546 CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities 08.11.2026 5.4
CVE-2026-18668 Protection Mechanism Failure vulnerability affects IBM Sterling File Gateway 08.11.2026 6.5
CVE-2026-18194 IBM App Connect Enterprise is vulnerable to a clickjacking attack 08.11.2026 2.5
CVE-2026-18195 IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection 08.11.2026 4.2
CVE-2026-18196 IBM App Connect Enterprise web user interface and Administration REST API are vulnerable to html injection 08.11.2026 5.4
CVE-2026-18484 IBM ContextForge MCP Gateway is affected by a denial-of-service via tool name collision through slug normalization 08.11.2026 6.5
CVE-2026-18525 IBM Sterling Secure Proxy is vulnerable to multiple issues 08.11.2026 4.9
CVE-2026-16699 Vulnerability exists in IBM Netezza Appliance 08.11.2026 6.5
CVE-2026-17437 IBM App Connect Enterprise is vulnerable to an arbitrary file write 08.11.2026 5.5
CVE-2026-17466 IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities 08.11.2026 9.1
CVE-2026-18093 IBM App Connect Enterprise is vulnerable to a credential exposure 08.11.2026 7.5
CVE-2026-15266 Multiple Vulnerabilities in IBM Concert Software 08.11.2026 9.8
CVE-2026-16325 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 4.4
CVE-2026-16427 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 6.5
CVE-2026-16433 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 6.5
CVE-2026-14963 IBM Cognos Command Center has addressed vulnerabilities 08.11.2026 4.3
CVE-2026-76052 The following vulnerabilities that can affect IBM Storage Scale and IBM Storage Scale System and the Management GUI are now fixed in 5.2.3.9/6.2.3.7 or higher and 6.0.1.1/7.0.1.1 or higher 08.11.2026 6
CVE-2026-14437 IBM Storage Scale Path Traversal 08.11.2026 6.5
CVE-2026-14469 IBM Storage Scale Incorrect Authorization 08.11.2026 5.4
CVE-2026-14377 IBM Turbonomic kubeturbo agent, used by IBM Turbonomic Application Resource Management, is affected by a security vulnerability 08.11.2026 5.4
CVE-2026-14434 IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by vulnerability 08.11.2026 5.9
CVE-2026-14435 IBM Turbonomic kubeturbo agent used by IBM Turbonomic Application Resource Management is affected by a vulnerability 08.11.2026 5.9
CVE-2026-120113 Multiple vulnerabilities in IBM Aspera Connect 08.11.2026 6.4
CVE-2026-120115 Multiple vulnerabilities in IBM Aspera Connect 08.11.2026 6.3
CVE-2026-12735 IBM Controller Disclosure Management has addressed vulnerabilities 08.11.2026 4.3
CVE-2026-12737 IBM Sterling B2B Integrator and IBM Sterling File Gateway affected by Exposure of Sensitive Information in Logs Vulnerability 08.11.2026 4.4
CVE-2026-14375 The following vulnerabilities that can affect IBM Storage Scale Install Toolkit are now fixed in 5.2.3.9 or higher and 6.0.1.1 or higher 08.11.2026 5.9
CVE-2026-115554 Tivoli Netcool/OMNIbus Web GUI is vulnerable to stored cross-site scripting 08.11.2026 6.4
CVE-2026-116499 Arbitrary Code Execution in Qiskit SDK QPY Deserialization 09.11.2026 8.4
CVE-2026-116500 Unbound Recursion in QPY deserialization can lead to denial of service 08.11.2026 6.2
CVE-2026-116501 Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary(). 09.11.2026 8.4
CVE-2026-117545 IBM webMethods Integration Server is vulnerable of bypassing the two-factor authentication mechanism. 08.11.2026 8.8
CVE-2026-119670 Vulnerabilities in spring-context, logback-core and Another JSON Schema Validator might affect IBM Storage Defender Copy Data Management 08.11.2026 6.3
CVE-2026-11547 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities 08.11.2026 4.3
CVE-2026-108292 Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026 08.11.2026 5.5
CVE-2026-10844 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities 08.11.2026 4.3
CVE-2026-110273 Security Vulnerability identified in IBM TRIRIGA - Command Execution 09.11.2026 8.8
CVE-2026-112369 Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026 08.11.2026 4.3
CVE-2026-113698 IBM® Db2® is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table 08.11.2026 6.5
CVE-2026-114464 Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026 08.11.2026 9.3
CVE-2026-105467 IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSS 08.11.2026 8.1
CVE-2026-105473 IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSS 08.11.2026 4.6
CVE-2026-107330 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 7.7
CVE-2026-107331 DataStage on Cloud Pak for Data has several vulnerabilities 08.11.2026 9.9
CVE-2026-108284 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities 08.11.2026 6.5
CVE-2025-36075 IBM Safer Payments could allow an authenticated user to obtain sensitive information 08.11.2026 5.3
CVE-2026-101117 IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks. 08.11.2026 9.1
CVE-2026-102618 IBM i is Affected by a Protection Mechanism Failure 08.11.2026 3.6
CVE-2026-103320 IBM WebSphere Application Server Liberty prior to 26.0.0.11 is affected by multiple vulnerabilities 08.11.2026 4.3
CVE-2025-0166 Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge 08.11.2026 2.7
CVE-2025-1837 Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge 08.11.2026 5.4
CVE-2026-109899 WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability 08.11.2026 7.1
CVE-2026-109900 WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability 08.11.2026 9.6
CVE-2026-114186 WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability 08.11.2026 6.5
CVE-2026-114188 WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability 08.11.2026 6.5
CVE-2026-114189 WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerability 08.11.2026 8.5
CVE-2026-120858 WordPress FluentForm plugin <= 6.2.16 - Broken Access Control vulnerability 08.11.2026 6.5
CVE-2026-61987 WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.8.1 - Cross Site Scripting (XSS) vulnerability 08.11.2026 6.5
CVE-2024-41786 IBM Engineering Requirements Management DOORS Next for J2EE File Disclosure Rule 08.11.2026 5.3