Export limit exceeded: 421837 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421837 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12737 | 1 Ibm | 2 Sterling B2b Integrator, Sterling File Gateway | 2026-11-08 | 4.4 Medium |
| IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.1_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.1_1 stores potentially sensitive information in log files that could be read by a local privileged user. | ||||
| CVE-2026-12735 | 1 Ibm | 1 Controller Disclosure Management | 2026-11-08 | 4.3 Medium |
| IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage. | ||||
| CVE-2026-120113 | 1 Ibm | 1 Aspera Connect | 2026-11-08 | 6.4 Medium |
| IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web page, an attacker could perform unauthorized cross-origin requests to read and modify configuration. | ||||
| CVE-2026-117545 | 1 Ibm | 1 Webmethods Integration Server | 2026-11-08 | 8.8 High |
| IBM webMethods Integration Server 12.1 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication. | ||||
| CVE-2026-116500 | 1 Ibm | 1 Qiskit Sdk | 2026-11-08 | 6.2 Medium |
| IBM Qiskit SDK 2.4.0 through 2.6.1 could allow a local attacker to cause a denial of service due to unbound recursion during deserialization of untrusted QPY payloads. | ||||
| CVE-2026-11547 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-11-08 | 4.3 Medium |
| IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 is affected by a server-side request forgery vulnerability in the Admin Center deploy validation endpoint. | ||||
| CVE-2026-114464 | 1 Ibm | 1 Process Mining | 2026-11-08 | 9.3 Critical |
| IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control. | ||||
| CVE-2026-112369 | 1 Ibm | 1 Process Mining | 2026-11-08 | 4.3 Medium |
| IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to perform unauthorized actions due to client-side enforcement of sever side security mechanisms. | ||||
| CVE-2026-10844 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-11-08 | 4.3 Medium |
| IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks. | ||||
| CVE-2026-108292 | 1 Ibm | 1 Process Mining | 2026-11-08 | 5.5 Medium |
| IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened. | ||||
| CVE-2026-107331 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-08 | 9.9 Critical |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability. | ||||
| CVE-2026-107330 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-11-08 | 7.7 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery (SSRF) vulnerability. | ||||
| CVE-2026-105467 | 1 Ibm | 1 Qradar Security Information And Event Manager | 2026-11-08 | 8.1 High |
| IBM QRadar 7.5.0 through 7.5.0 Update Pack 16 Interim Fix 02, and 7.6.0.0 through 7.6.0.5 is vulnerable to Reflected XSS. A victim must open a specifically crafted URL while authenticated to QRadar to trigger this. | ||||
| CVE-2026-102618 | 1 Ibm | 1 I | 2026-11-08 | 3.6 Low |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable. | ||||
| CVE-2026-101117 | 1 Ibm | 1 Websphere Extreme Scale | 2026-11-08 | 9.1 Critical |
| IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.2.2 could allow a remote attacker to bypass security restrictions due to improper Content Security Policy configuration. | ||||
| CVE-2025-36075 | 1 Ibm | 1 Safer Payments | 2026-11-08 | 5.3 Medium |
| IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could exploit this vulnerability to decrypt sensitive information. | ||||
| CVE-2026-115718 | 1 Frappe | 1 Builder | 2026-11-08 | 4.3 Medium |
| Frappe Builder versions 1.33.0 before 1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attackers can call the improve_prompt API to leverage the site owner's stored OpenRouter API key via resolve_api_key, consuming paid LLM credits and effectively turning the site into a free LLM proxy. | ||||
| CVE-2026-124425 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-08 | 3.1 Low |
| Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure vulnerability in which create or update responses mark fields as deleted based on stored values the caller cannot read. Attackers with write but not read access to an object can inspect these markers to infer whether protected fields are set. | ||||
| CVE-2026-124435 | 1 Openremote | 2 Core, Openremote | 2026-11-08 | 4.8 Medium |
| OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with write:admin permissions to upload HTML or SVG files containing JavaScript via the Manager configuration file upload endpoint. Attackers can lure victims to the unauthenticated image retrieval endpoint, which serves files as text/html or image/svg+xml, executing scripts within the application's origin. | ||||
| CVE-2025-1837 | 1 Ibm | 1 Watsonx Orchestrate Cartridge For Cloud Pak For Data | 2026-11-08 | 5.4 Medium |
| IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods. | ||||