Archive
8 November 2026
Vulnerabilities first published on this day (UTC), newest first.
21 results · Clear filters · Feed
-
Critical 9.8
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0 through 3.0.1.1 allows an attacker can supply crafted input that is incorporated into an operating system command without adequate validation or sanitization. Successful exploitation allows remote attackers to execute arbitrary commands on the…
-
Critical 9.1
IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities
IBM Optim 1.0.0, 1.1.0, and 1.2.0 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.
-
Critical 9.8
Multiple Vulnerabilities in IBM Concert Software
IBM Concert 1.0 through 3.0.1.1 contains components that allow potentially unsafe command execution, which could be exploited to run arbitrary system commands on the host.
-
Critical 9.3
Multiple security vulnerabilities are addressed with IBM Process Mining Interim Fix for October 2026
IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control.
-
Critical 9.9
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.
-
Critical 9.1
IBM WebSphere eXtremes Scale Liberty deployment is affected by Cross Site Scripting(XSS) attacks.
IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration.
-
Critical 9.6
WordPress Melapress Role Editor plugin <= 1.3.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: from n/a through 1.3.0.
-
Critical 9.3
SunEditor before 3.4.0 Stored XSS via DocumentType Header textContent
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript…
-
Critical 9.3
SunEditor before 3.4.0 Stored XSS via : Entity Sanitizer Bypass
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean() sanitizer's _normalizeURL() function decodes named entities like : to an empty string. Attackers can inject href values such as javascript: that p…
-
Critical 9.1
OpenEMR before 8.3.0 Arbitrary File Read/Write via oe-module-faxsms disposeDocument
OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument() method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the file_path parameter. Attackers can use actio…
-
Critical 9.9
OpenEMR before 8.3.0 SQL Injection via Fee Sheet warehouse parameter
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup (DrugSalesService::sellDrug) that interpolates the prod[N][warehouse] POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee She…
-
Critical 9.9CVE-2026-124450 Public exploit
OpenEMR before 8.3.0 Arbitrary File Read/Write via disposeDocument
OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module disposeDocument action via an unvalidated file_path parameter. Authenticated low-privilege users can read sqlconf.php to recover database credentials …
-
Critical 9.8
OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force
OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. At…
-
Critical 9.9
Kyverno 1.19.1 Privilege Escalation via apiCall Namespace Clamp Bypass
Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that allows namespace tenants to issue cross-namespace and cluster-scoped API requests by appending malformed percent-escapes to urlPath. Attackers…
-
Critical 9.8
Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next
Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entri…
-
Critical 9.8
Userplace <= 1.2.0 - Unauthenticated Privilege Escalation
The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or w…
-
Critical 9.8
Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 Filename
The Contact Form 7 WordPress plugin before 6.2.4 does not validate the type or extension of files uploaded through a form file field, and a flaw in its temporary-file cleanup leaves the uploaded file on disk, allowing unauthenticated users to upload arbitrary…
-
Critical 9.8
imgproxy 4.0.0 before 4.0.16 Heap Buffer Overflow via ICO Loader Integer Overflow
imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vip…
-
Critical 10.0
OpenAM 14.0.0 before 16.1.4 Session Token Disclosure via Notification WebSocket
OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forw…
-
Critical 9.8
OpenAM before 16.1.4 SAML Authentication Bypass via Unsigned Assertions
OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submi…
-
Critical 9.8
OpenAM before 16.1.4 Privilege Escalation via Self-Registration Attribute Bypass
OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous attackers to set restricted attributes including group membership. Attackers can register through the legacy self-service REST endpoint or Us…