Archive
8 November 2026
Vulnerabilities first published on this day (UTC), newest first.
96 results · Clear filters · Feed
-
High 7.3
Tidelift moto AWS Batch Emulation models.py privileges management
A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privilege management. Remo…
-
High 8.1
IBM webMethods Integration Server is affected by vulnerabilty in backup code validation during 2FA Authentication.
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
-
High 7.5
Multiple vulnerabilities previously addressed in IBM SevOne Network Performance Management
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
-
High 8.1
Langflow OSS is affected by multiple vulnerabilities
IBM Langflow OSS 1.0.0 through 1.12.2 An authenticated flow author could write attacker-controlled file content into any directory writable by the service account, bypassing the platform's local file access isolation safeguard. Via a crafted on-disk index, th…
-
High 8.8
IBM Bob is vulnerable to Remote Code Execution due to improper control of workspace-defined MCP server execution
IBM Bob 1.0.4 through 2.0.1 could allow a remote attacker to inject arbitrary code on the system, due to the improper control of user input code.
-
High 7.5
Hibernate Validator is affected by an expression language injection vulnerability
Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language (EL) expressions.
-
High 8.8
IBM Verify Directory is affected by multiple vulnerabilities
IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 is vulnerable to session fixation. An attacker can establish a session and, after the victim authenticates, hijack the authenticated session to gain unauthorized access to the…
-
High 8.1
TS4500 Tape Library addresses security vulnerability
IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to perform unauthorized account takeover due to improper authorization.
-
High 7.1
CockroachDB PostgreSQL for IBM VPC is affected by multiple vulnerabilities
IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function.
-
High 7.5
IBM App Connect Enterprise is vulnerable to a credential exposure
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.
-
High 8.8
IBM webMethods Integration Server is vulnerable of bypassing the two-factor authentication mechanism.
IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.
-
High 8.4
Qiskit SDK C API may trigger an out of bounds write on accessing the unitary matrix with qk_circuit_inst_unitary().
IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to execute arbitrary code due to an out-of-bounds write caused by improper input validation when accessing a corrupted unitary matrix.
-
High 8.4
Arbitrary Code Execution in Qiskit SDK QPY Deserialization
IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.
-
High 8.8
Security Vulnerability identified in IBM TRIRIGA - Command Execution
IBM TRIRIGA Application Platform 5.0.0 through 5.0.9 IBM TRIRIGA could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
-
High 7.7
DataStage on Cloud Pak for Data has several vulnerabilities
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability.
-
High 8.1
IBM QRadar SIEM is vulnerable to Open Redirect and Reflected XSS
IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this.
-
High 8.5
WordPress AnyWhere Elementor plugin <= 1.3.0 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Blind SQL Injection.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
-
High 7.1
WordPress Melapress Role Editor plugin <= 1.3.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0.
-
High 7.5
BabelDOC from 0.3.61 before 0.7.0 Denial of Service via ToUnicode CMap Parsing
BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares …
-
High 7.3
Jinher OA ProjectAfficheManage.aspx sql injection
A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack …
-
High 7.6
SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List
SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encod…
-
High 7.1
OpenEMR before 8.3.0 Broken Access Control via portal_payment.php
OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and form_pid parameters …
-
High 8.1
OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters
OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan dire…
-
High 8.8
OpenEMR before 8.3.0 Missing Authorization in Classic Document Controller
OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke move_action_process to move a document into a …
-
High 8.3
OpenEMR before 8.4.0 Improper Authorization via Prescription REST API
OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Aut…
-
High 8.8
OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs
OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, r…
-
High 8.8
OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN
OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token…
-
High 8.8
OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php
OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php w…
-
High 7.1
OpenEMR before 8.3.0 IDOR via portal/lib/persist.php setting_patient
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary setting_patient value. Attackers can insert or ove…
-
High 8.1
OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id pa…
-
High 7.1
OpenEMR before 8.3.0 Broken Object Authorization via SOAP Note Update API
OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID (sid) belongs to the supplied patient and encounter. Authenticated users with encounters/notes pe…
-
High 8.1
OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php
OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and …
-
High 7.1
OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API
OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-…
-
High 7.2
OpenEMR before 8.4.0 Unauthenticated SSRF via OAuth2 Client jwks_uri
OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwks_uri. Attackers can trigger the fetch via the token i…
-
High 8.8
OpenEMR before 8.4.0 Remote Code Execution via ESign LFI and fax upload
OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the unsanitized module parameter into a require_once of '<module>/Controller.php', and the fax module's faxProcessUploads writes attacker-named f…
-
High 8.7
OpenEMR before 8.3.0 Stored XSS via CAMOS Rx Print View
OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajax_save.php. Attackers can store a script payload that executes unencoded wh…
-
High 8.1
OpenEMR before 8.3.0 IDOR via DICOM library/ajax/upload.php Endpoint
OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary doc_id. Low-privilege users can enumerate doc_id values with the fe…
-
High 8.1
OpenEMR before 8.3.0 Cross-Patient IDOR via Encounter Form Viewers and Save Handlers
OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such …
-
High 7.1
OpenEMR before 8.3.0 Missing Authorization and IDOR in Prior-Authorizations Module
OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can requ…
-
High 7.6
OpenEMR before 8.3.0 Path Traversal via sl_eob_process.php eraname
OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences…