Archive
November 2026
Vulnerabilities first published in this month (UTC), newest first.
7,973 results · Feed
-
Medium 5.3
A weakness has been identified in Akaunting up to 3.3.0. The affected element is the function calculation_to_quantity o…
-
Medium 5.1
A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.3. Impacted is the function VelocityUtils.getFileN…
-
Medium 6.4
The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 't…
-
Medium 6.9
A vulnerability has been found in projectworlds Visitor Management System 1.0. This issue affects the function mysqli_q…
-
Medium 5.9
create-ecdh: computeSecret does not validate that the peer public key is on the curve (invalid-curve attack)
create-ecdh is a browserifiable implementation of Node.js crypto.createECDH. In versions 4.0.4 and below, the JavaScript implementation (browser.js, used by browser bundlers and on Node.js versions without a working native crypto.createECDH) did not validate …
-
Unscored —
The WP Ultimate CSV Importer WordPress plugin before 9.2, WP Ultimate CSV Importer Pro WordPress plugin before 9.0.7 do…
-
Unscored —
The WP Ultimate CSV Importer WordPress plugin before 9.3 does not escape values from imported files before using them i…
-
Unscored —
The Quick Page/Post Redirect Plugin WordPress plugin before 5.2.4 was distributed with a hidden update mechanism that f…
-
Unscored —
The Duplicate Post WordPress plugin before 1.5.8 does not check that a user duplicating a post is allowed to edit it, w…
-
Unscored —
The Duplicate Post WordPress plugin before 1.5.8 does not check whether a user may publish posts when duplicating one, …
-
Unscored —
The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress sessio…
-
Unscored —
The SEOJuice WordPress plugin before 2.12.0 does not correctly restrict a REST API authentication filter, disabling Wor…
-
Unscored —
The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.1 does not verify that a file uploaded at checkou…
-
Unscored —
The Lightbox with PhotoSwipe WordPress plugin before 5.19.0 does not properly sanitise link titles and other caption so…
-
Unscored —
The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several …
-
Unscored —
The Chargely Free Subscriptions For Woocommernce WordPress plugin through 1.0 does not perform any authorization check …
-
Unscored —
The Flatsome WordPress theme before 3.20.13 does not perform a capability or nonce check on an AJAX action available to…
-
Unscored —
The Flatsome WordPress theme before 3.20.13 does not enforce the acting user's publish and post-type restrictions on an…
-
Unscored —
The Duplicate Post WordPress plugin before 1.5.8 does not perform a capability check when saving its global settings, r…
-
Unscored —
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not perform authorization or nonce checks w…
-
Unscored —
The Countdown, Coming Soon, Maintenance WordPress plugin through 3.0.8 does not check that the user is allowed to brows…
-
Unscored —
The Email Marketing 4Dem WordPress plugin through 2.0.5 does not perform authorization or capability checks on several …
-
Critical 9.8
The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, an…
-
High 7.1
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vul…
-
High 8.6
PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservic…
-
High 8.6
PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding …
-
Medium 6.9
A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_qu…
-
High 7.8
NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research …
-
Medium 5.3
Stirling-Tools Stirling-PDF Participant Details Endpoint WorkflowParticipantController.java session timeout
A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.0. Affected is the function WorkflowParticipantController.getParticipantDetails of the file app/proprietary/src/main/java/stirling/software/proprietary/workflow/controller/WorkflowPa…
-
Medium 6.4
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information…
-
Medium 6.5
IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to obtain sensitive informatio…
-
High 8.1
IBM Security QRadar EDR 3.12 through 3.12.26 could allow a remote authenticated attacker to bypass security restriction…
-
High 7.5
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log sen…
-
High 8.1
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands is vulnerable to Log Forging on a…
-
High 8.7
: Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra, John…
-
Medium 6.0
IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands Hard-coded Credentials
IBM App Connect Operator and App Connect Enterprise Certified Containers Operands could allow an attacker with the ability to run HTTP calls within the running container to can make administrative calls to a running IntegrationRuntime.
-
Medium 6.3
CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR…
-
Low 3.3
IBM Bob is vulnerable to unauthorized session token exposure due to improper handling of authentication provider session information
IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious ext…
-
High 7.0
Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson Co…
-
High 7.5
IBM webMethods Integration Server is vulnerable to sensitive information disclousure via admin/server/env API request.
IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.